NodeBB fails to validate that the attributedTo field of an incoming ActivityPub object matches the authenticated remote actor. This oversight, captured as CWE‑290 and CWE‑345, allows a federated actor to supply a bare numeric UID in attributedTo, causing the server to create posts or private messages on behalf of that local UID, including the administrator account. The result enables a remote attacker to forge content with any local user’s identity, bypassing all local authentication controls.

NodeBB version 4.13.2 is documented as affected. All installations that have the ActivityPub/federation feature enabled and are running that version are potentially vulnerable. The vendor and product is NodeBB.

The flaw carries a CVSS score of 8.7, indicating high severity, while the EPSS score is less than 1%, suggesting a low current exploitation likelihood. The vulnerability is not listed in CISA KEV. This vulnerability is only exploitable when the NodeBB instance has the ActivityPub federation feature enabled. Based on the description, it is inferred that the likely attack vector is a remote actor with network connectivity to the instance, sending a crafted ActivityPub activity containing a numeric attributedTo value; this allows the attacker to create posts or direct messages as any local user, including administrative privileges, without any local privileges or credential reuse.