Is CVE-2026-120007 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-120007?

CVE-2026-120007 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-120007

Description

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions.