NodeBB versions 1.18.0 through 4.16.5 contain a flaw that lets an unauthenticated user supply a uid during the POST /register request. By packetting a uid of an existing account, the attacker can complete the registration interstitial with an empty email, which clears that account’s email address and confirmation flag and forcibly revokes all of the victim’s active sessions. The result is that an attacker gains unilateral control over another member’s account, including the ability to remove their address, reset authentication state, and terminate legitimate sessions.

The vulnerability affects the NodeBB forum software, any installation running version 1.18.0 up to and including 4.16.5. Any deployment that exposes the standard registration endpoint to the public is potentially exploitable.

The flaw has a CVSS score of 6.9, indicating moderate severity. No EPSS score is published, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a remote, unauthenticated web request; an attacker can trigger the issue from any network location that can reach the forum’s registration page. Because the defect allows direct manipulation of user data and session state, the risk to affected installations is significant if the system is exposed to the internet.