EIP-2026-104189

The writeup describes a broken access control vulnerability in NodeBB v3.6.7, where an attacker can manipulate JSON response parameters to gain unauthorized access to admin-restricted tabs. The steps involve intercepting and modifying specific attributes in the group section response.