CVE-2026-106991: High severity vulnerability

Q: Who can exploit this issue?

Any registered user can exploit it. The vulnerable thread administration path checks only that the requester is logged in and does not verify thread ownership or administrative privileges.

Q: What actions can an unauthorized user perform?

A registered user can delete, lock, or mark forum threads as sticky. This includes threads containing administrator announcements.

Q: Are administrator accounts or special permissions required?

No. Exploitation requires only a registered, authenticated user account; the affected code path does not enforce authorship or administrator authorization.

Published Nov 3, 2026

Updated

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

Event History

Nov 3, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Data Sourced

via NVD·03:17 PM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this issue?

Any registered user can exploit it. The vulnerable thread administration path checks only that the requester is logged in and does not verify thread ownership or administrative privileges.

What actions can an unauthorized user perform?

A registered user can delete, lock, or mark forum threads as sticky. This includes threads containing administrator announcements.

Are administrator accounts or special permissions required?

No. Exploitation requires only a registered, authenticated user account; the affected code path does not enforce authorship or administrator authorization.

CVE-2026-106991: High severity vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions can an unauthorized user perform?

Are administrator accounts or special permissions required?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions can an unauthorized user perform?

Are administrator accounts or special permissions required?