Skip to content
Threat Feed
Subscribe

Vendor

NodeBB

1 brief RSS
high advisory

CVE-2026-58593: NodeBB ActivityPub Forgery Vulnerability

A critical vulnerability (CVE-2026-58593) in NodeBB's ActivityPub implementation allows a remote attacker to forge posts and direct messages attributed to arbitrary local users, including administrators, by manipulating the 'attributedTo' field in inbound ActivityPub objects.

PoC NodeBB +1 activitypub federation vulnerability web-application cms forgery
1t 1c updated