{"id":"CVE-2024-29316","aliases":["EUVD-2024-0988","GHSA-qc99-r4wh-c8h6"],"status":"published","title":"Incorrect Access Control in NodeBB","description":"NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via \"isadmin\":true.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0043,"percentile":0.37505,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-03-28T00:00:00Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"npm","package":"nodebb","fixed_in":["3.6.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nodebb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7"}]}]},{"source":"osv","ecosystem":"npm","package":"nodebb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.7"}]}]}],"products":[{"vendor":"nodebb","product":"nodebb"}],"references":[{"url":"https://nodebb.org/bounty/","tags":["x_transferred","Product","web"]},{"url":"https://medium.com/%40krityamkarma858041/broken-access-control-nodebb-v3-6-7-eebc59c24deb","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29316","tags":["advisory"]},{"url":"https://nodebb.org/bounty","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qc99-r4wh-c8h6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29316.json","tags":["advisory"]},{"url":"https://github.com/NodeBB/NodeBB","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-29316","description":"NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via \"isadmin\":true.","status":"published","published":"2024-03-28T00:00:00Z","modified":"2024-11-15T20:29:31.838Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-0988","description":"NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via \"isadmin\":true.","status":"published","published":"2024-03-28T00:00:00Z","modified":"2024-11-15T20:29:31Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:57.661321Z"}],"ghsa":[{"id":"GHSA-qc99-r4wh-c8h6","title":"Incorrect Access Control in NodeBB","description":"In NodeBB prior to 3.6.7 an attacker was able to access the restricted tabs for the Admin group which are only allowed the the administrators.","status":"published","published":"2024-03-29T00:30:34Z","modified":"2024-11-18T20:02:54Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2024-29316","description":"NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via \"isadmin\":true.","status":"published","published":"2024-03-28T23:15:46.47Z","modified":"2026-06-17T07:22:44.407Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:09:44.124823Z"}],"osv":[{"id":"CVE-2024-29316","description":"NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via \"isadmin\":true.","status":"published","published":"2024-03-28T00:00:00Z","modified":"2026-10-28T02:30:30.619885072Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-qc99-r4wh-c8h6","title":"Incorrect Access Control in NodeBB","description":"In NodeBB prior to 3.6.7 an attacker was able to access the restricted tabs for the Admin group which are only allowed the the administrators.","status":"published","published":"2024-03-29T00:30:34Z","modified":"2024-11-18T20:12:14.675827Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}