NodeBB version 3.6.7 suffers from a broken access control that lets attackers via data only meant for an administrator.