ActivityPub Author Spoofing in NodeBB by a Remote Actor
CVE-2026-58593
Key Information:
Badges
What is CVE-2026-58593?
NodeBB's implementation of ActivityPub allows for an author spoofing vulnerability, where a remote actor can impersonate local users by manipulating the 'attributedTo' field in inbound ActivityPub objects. This is due to inadequate validation processes that fail to ensure that the 'attributedTo' mapping corresponds correctly to the authenticated actor. As a result, an attacker could create posts or private messages that appear to originate from any local user, including administrators, thereby undermining user trust and the integrity of content shared within the NodeBB platform. The vulnerability is particularly concerning for instances where the ActivityPub feature is enabled, as it expands the risk of unauthorized actions within the community.
Affected Version(s)
NodeBB 4.13.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.