CVE Watch3 nov 2026

CVE-2026-106991

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread

CVSS

7.1

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 3 nov 2026 · Última mod.: 3 nov 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

Referencias oficiales

github.comhttps://github.com/MX-Qulin/CVE-2026-106991
github.comhttps://github.com/zhblue/hustoj
github.comhttps://github.com/zhblue/hustoj/pull/1192

CVEs relacionados

Sin CVEs relacionados por CWE o producto.