CVE-2026-106991
Deferred Deferred - Pending Action

Incorrect Access Control in HUSTOJ Forum Software

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: MITRE

Description
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-106991
EUVD
EUVD-2026-115851

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Access Control flaw in HUSTOJ versions between 24.09.10 and 26.08.19. Any registered user can delete, lock, or sticky forum threads (including admin announcements) via threadadmin.php. The system only checks if a user is logged in but does not verify if they are the thread author or an administrator, allowing unauthorized actions.

Detection Guidance

Check if your HUSTOJ version is between 24.09.10 and 26.08.19 by running: grep -r "version" /path/to/hustoj | grep -E "24.09.10|26.08.19". Verify if threadadmin.php exists and lacks authorization checks by inspecting the file for missing user permission validations.

Impact Analysis

An attacker could exploit this to delete or modify important forum threads, including admin announcements, disrupting communication or spreading misinformation. They could also lock threads to prevent discussions or sticky threads to highlight unwanted content. The impact depends on the forum's role in your system.

Mitigation Strategies
  • Upgrade HUSTOJ to version 26.09.12 or later immediately to apply the fix from PR #1192.
  • Temporarily disable the forum feature by setting $OJ_BBS="" in the configuration file if upgrading is not immediately possible.
  • Restrict access to threadadmin.php by IP or disable it entirely until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...