Finding eight high-severity vulnerabilities in NodeBB in six hours

This technical disclosure describes an autonomous whitebox pentest of NodeBB (pre-4.14.0) that discovered multiple high-severity vulnerabilities — including several XSS vectors (via federated profile icons, federation error logs, and translation/template injection), authorization bypasses exposing admin pages, ActivityPub signature verification flaws allowing user impersonation and private message disclosure, mass-assignment allowing post hijacking, and unauthenticated access to category outboxes. Each issue is explained with proof-of-concept steps and mitigations; maintainers patched the problems in version 4.14.0.