CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation...