CVE-2021-43786

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Nov 29, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-437876.1Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowCVE-2021-437885.0Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to acCVE-2021-437899.8PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection usingCVE-2021-43796.5The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_CVE-2021-437908.1Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published toCVE-2021-437915.3Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration datCVE-2021-437924.3Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visiCVE-2021-437934.3Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple tiCVE-2021-437945.3Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) usCVE-2021-437957.5Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond iCVE-2021-437976.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2021-437987.5Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions
CVE-2021-43786: High severity, CVSS 7.5 | Vulnix