CVE-2026-120007

NodeBB versions 1.18.0 through 4.16.5 are susceptible to an authorization bypass vulnerability. Unauthenticated visitors can act on other accounts by supplying a uid during a POST /register request. Specifically, an attacker can submit an empty email at the /register/complete interstitial to clea...