CVE Watch7 de nov. de 2026

CVE-2026-106991

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread

CVSS

7.1

Alta

EPSS

0.4%

p36

KEV

—

Exploit Today

0-100

Publicado: 3 de nov. de 2026 · Última mod.: 7 de nov. de 2026

EPSS · 30d

0.4%EPSS · 30 dias0.4%

2026-11-042026-11-07

Descrição técnica

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

Referências oficiais

github.comhttps://github.com/MX-Qulin/CVE-2026-106991
github.comhttps://github.com/zhblue/hustoj
github.comhttps://github.com/zhblue/hustoj/pull/1192
github.comhttps://github.com/MX-Qulin/CVE-2026-106991

CVEs relacionados

Nenhum CVE relacionado por CWE ou produto.