CVE WatchNov 3, 2026

CVE-2026-106991

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread

CVSS

7.1

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 3, 2026 · Last modified: Nov 3, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

Official references

github.comhttps://github.com/MX-Qulin/CVE-2026-106991
github.comhttps://github.com/zhblue/hustoj
github.comhttps://github.com/zhblue/hustoj/pull/1192

Related CVEs

No related CVEs by CWE or product.