WS-2026-0020

NodeBB before v4.14.0: post hijacking via PID mass assignment - POST /api/v3/topics allowed a client-supplied pid to overwrite an existing post id, enabling takeover of arbitrary posts. Fixed in 4.14.0. One of eight Aikido-disclosed flaws; no CVE assigned...