WS-2026-0022

NodeBB before v4.14.0: upvote inflation via unchecked actor - ActivityPub POST requests without an HTTP signature header were accepted, letting an unchecked actor inflate upvotes and perform other actor-attributed actions. Fixed in 4.14.0 by rejecting unsigned POSTs. One of eight Aikido-disclosed...