NodeBB fails to validate that the attributedTo field of an incoming ActivityPub object matches the authenticated remote actor. This oversight, captured as CWE‑290 and CWE‑345, allows a federated actor to supply a bare numeric UID in attributedTo, causing the server to create posts or private messages on behalf of that local UID, including the administrator account. The result enables a remote attacker to forge content with any local user’s identity, bypassing all local authentication controls.

NodeBB version 4.13.2 is documented as affected. All installations that have the ActivityPub/federation feature enabled and are running that version are potentially vulnerable. The vendor and product is NodeBB.

The flaw carries a CVSS score of 8.7, indicating high severity, while the EPSS score is less than 1%, suggesting a low current exploitation likelihood. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the likely attack vector is a remote actor with network connectivity to the instance, sending a crafted ActivityPub activity containing a numeric attributedTo value; this allows the attacker to create posts or direct messages as any local user, including administrative privileges, without any local privileges or credential reuse.