CVE-2021-43786: Improper Authentication

November 29, 2021 (updated October 27, 2022)

Incorrect logic present in the token verification step unintentionally allowed master token access to the API.

References

github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500
github.com/NodeBB/NodeBB/releases/tag/v1.18.5
github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw
nvd.nist.gov/vuln/detail/CVE-2021-43786

Code Behaviors & Features

Detect and mitigate CVE-2021-43786 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →