GitHub Advisoryadvisory · npm

GHSA-qc99-r4wh-c8h6 Incorrect Access Control in NodeBB

MEDIUM Published 2024-03-29 Modified 2024-11-18 Official page ↗

Aliases: CVE-2024-29316
Ecosystem: npm
Packages: nodebb
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Reviewed: 2024-11-18

Affected packages

• npm nodebb: < 3.6.7 → fixed in 3.6.7

Description

In NodeBB prior to 3.6.7 an attacker was able to access the restricted tabs for the Admin group which are only allowed the the administrators.

Related

Alias · CVE (1)

CVE-2024-29316 NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group… vulnerability

References