CVE-2021-43786

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

• CWE-287

• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
• https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500Patch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Release Notes, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqwThird Party Advisory
• https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/Exploit, Third Party Advisory
• https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500Patch, Third Party Advisory
• https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5Release Notes, Third Party Advisory
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqwThird Party Advisory

Published

Nov 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43780Redash is a package for data visualization and sharing. In v…8.8
• CVE-2021-43781Invenio-Drafts-Resources is a submission/deposit module for …4.3
• CVE-2021-43782Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-43783@backstage/plugin-scaffolder-backend is the backend for the …8.5
• CVE-2021-43784runc is a CLI tool for spawning and running containers on Li…5
• CVE-2021-43785@joeattardi/emoji-button is a Vanilla JavaScript emoji picke…6.1
• CVE-2021-43787Nodebb is an open source Node.js based forum software. In af…6.1
• CVE-2021-43788Nodebb is an open source Node.js based forum software. Prior…5
• CVE-2021-43789PrestaShop is an Open Source e-commerce web application. Ver…9.8
• CVE-2021-4379The WooCommerce Multi Currency plugin for WordPress is vulne…6.5
• CVE-2021-43790Lucet is a native WebAssembly compiler and runtime. There is…8.1
• CVE-2021-43791Zulip is an open source group chat application that combines…5.3