| Package | Affected versions | Patched versions |
|---|---|---|
| nodebb | ≥ 1.15.0, ≤ 1.18.4 | |
| nodebb | ≥ 1.15.0, < 1.18.5 | 1.18.5 |
Incorrect logic present in the token verification step unintentionally allowed master token access to the API.
The vulnerability has been patch as of v1.18.5.
Cherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free