Threats tagged 'ghsa-2xj9-m79m-chvg'

NodeBB versions 1.18.0 through 4.16.5 have an authorization bypass vulnerability that permits unauthenticated users to act on behalf of other accounts by supplying a user ID during the POST /register request. This flaw also allows attackers to clear a victim's email and confirmation state and revoke all their sessions by submitting an empty email at the /register/complete step.