WS-2026-0021

NodeBB before v4.14.0: unauthorized category access without authentication - the ActivityPub category outbox route lacked a privilege gate, exposing category content without authorization. Fixed in 4.14.0 by adding a privilege check. One of eight Aikido-disclosed flaws; no CVE assigned...