CVE-2026-58593

What it is

NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out without re-deriving the uid), so a federated remote actor can set attributedTo to a bare numeric value such as 1 and have the resulting post or private message created with that local uid as author, including the administrator account. This lets a remote attacker forge posts and direct messages attributed to arbitrary local users. Requires the ActivityPub/federation feature to be enabled.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of data tampering.

Exploit odds

0.3% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-07-01 20:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-07-07 13:16 UTC Last updatedMost recent change to the record

Details

Published

2026-07-01 20:17 UTC

Last modified

2026-07-07 13:16 UTC

Exploit probability

0.3% · EPSS, next 30 days

Weakness

CWE-290

Record status

Analyzed

Affected

• Nodebb ≤ 4.13.2

Attack profile CVSS 4.0 · 8.7

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

High

Availability

None