{"id":"CVE-2021-43786","aliases":["EUVD-2021-2354","GHSA-hf2m-j98r-4fqw"],"status":"published","title":"API token verification can be bypassed","description":"Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02369,"percentile":0.83958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2021-11-29T19:30:17Z","modified":"2026-10-20T10:55:03Z","fixes":[{"ecosystem":"npm","package":"nodebb","fixed_in":["1.18.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nodebb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.18.5"}]}]},{"source":"osv","ecosystem":"npm","package":"nodebb","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.18.5"}]}]}],"products":[{"vendor":"nodebb","product":"nodebb"}],"references":[{"url":"https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43786","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hf2m-j98r-4fqw"},{"url":"https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot","tags":["web"]},{"url":"https://github.com/NodeBB/NodeBB","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-43786","title":"API token verification can be bypassed","description":"Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.","status":"published","published":"2021-11-29T19:30:17Z","modified":"2024-08-04T04:03:08.931Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2021-2354","description":"Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.","status":"published","published":"2021-11-29T19:30:17Z","modified":"2024-08-04T04:03:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:24:13.772922Z"}],"ghsa":[{"id":"GHSA-hf2m-j98r-4fqw","title":"API token verification can be bypassed in NodeBB ","description":"### Impact\nIncorrect logic present in the token verification step unintentionally allowed master token access to the API.\n\n### Patches\nThe vulnerability has been patch as of v1.18.5.\n\n### Workarounds\nCherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@nodebb.org](mailto:security@nodebb.org)\n","status":"published","published":"2021-11-30T22:21:05Z","modified":"2023-01-31T05:05:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:29.957996Z"}],"nvd":[{"id":"CVE-2021-43786","description":"Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.","status":"published","published":"2021-11-29T20:15:08.133Z","modified":"2026-06-17T04:11:26.233Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:01.811115Z"}],"osv":[{"id":"CVE-2021-43786","description":"Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.","status":"published","published":"2021-11-29T20:15:08.133Z","modified":"2026-10-20T10:55:03.222132065Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-hf2m-j98r-4fqw","title":"API token verification can be bypassed in NodeBB ","description":"### Impact\nIncorrect logic present in the token verification step unintentionally allowed master token access to the API.\n\n### Patches\nThe vulnerability has been patch as of v1.18.5.\n\n### Workarounds\nCherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@nodebb.org](mailto:security@nodebb.org)\n","status":"published","published":"2021-11-30T22:21:05Z","modified":"2026-07-08T06:28:56.284662247Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}