A critical vulnerability (CVE-2026-58593) in NodeBB's ActivityPub implementation allows a remote attacker to forge posts and direct messages attributed to arbitrary local users, including administrators, by manipulating the 'attributedTo' field in inbound ActivityPub objects.
PoC
NodeBB +1
activitypub
federation
vulnerability
web-application
cms
forgery
1t
1c
updated