CVE-2020-15149

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.

• CWE-269
• CWE-287

• http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.htmlThird Party Advisory, VDB Entry
• https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39Patch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7Patch, Third Party Advisory
• https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/Third Party Advisory
• http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.htmlThird Party Advisory, VDB Entry
• https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39Patch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7Patch, Third Party Advisory
• https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/Third Party Advisory

Published

Aug 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15142In openapi-python-client before version 0.5.3, clients gener…9
• CVE-2020-15143In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2…8.8
• CVE-2020-15145In Composer-Setup for Windows before version 6.0.0, if the d…8.2
• CVE-2020-15146In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2…8.8
• CVE-2020-15147Red Discord Bot before versions 3.3.12 and 3.4 has a Remote …8.5
• CVE-2020-15148Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to …10
• CVE-2020-1515An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15150There is a vulnerability in Paginator (Elixir/Hex package) w…9.8
• CVE-2020-15151OpenMage LTS before versions 19.4.6 and 20.0.2 allows attack…8
• CVE-2020-15152ftp-srv is an npm package which is a modern and extensible F…9.1
• CVE-2020-15153Ampache before version 4.2.2 allows unauthenticated users to…9.8
• CVE-2020-15154baserCMS 4.3.6 and earlier is affected by Cross Site Scripti…7.3