CVE-2024-29316

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group via "isadmin":true.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://medium.com/%40krityamkarma858041/broken-access-control-nodebb-v3-6-7-eebc59c24debThird Party Advisory
https://nodebb.org/bounty/Product
https://medium.com/%40krityamkarma858041/broken-access-control-nodebb-v3-6-7-eebc59c24debThird Party Advisory
https://nodebb.org/bounty/Product

Timeline

Published: Mar 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-293185.4Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascri CVE-2024-293199.8Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make CVE-2024-29327.5A vulnerability classified as critical has been found in SourceCodester Online Chatting System 1.0. Affected is an unknown function of the f CVE-2024-293208.1Wallos before 1.15.3 is vulnerable to SQL Injection via the category and payment parameters to /subscriptions/get.php.CVE-2024-29336.4The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Social Profiles widge CVE-2024-293382.4Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.CVE-2024-29349.8A vulnerability classified as critical was found in SourceCodester Todo List in Kanban Board 1.0. Affected by this vulnerability is an unkno CVE-2024-29356.1A vulnerability, which was classified as problematic, has been found in SourceCodester Todo List in Kanban Board 1.0. Affected by this issue CVE-2024-29365.4The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute of widgets in all versions up to,CVE-2024-293668.8A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03.CVE-2024-293686.5An arbitrary file upload vulnerability in the file handling module of moziloCMS v2.0 allows attackers to bypass extension restrictions via f CVE-2024-29377.8Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture K