GHSA-qc99-r4wh-c8h6

ghsaUSosv

Incorrect Access Control in NodeBB

view advisory published 2024-03-29Licence: CC-BY-4.0

In NodeBB prior to 3.6.7 an attacker was able to access the restricted tabs for the Admin group which are only allowed the the administrators.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-29316US	—	0.43% (37th)	—	2024-03-28
NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.