CVE-2026-106991
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control
- Risk score
- 43/100
- CVSS
- 7.1 v3.1
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
Original description
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
Last activity 3 Nov 2026. Patch Forecast updates every hour.