CVE-2026-106991

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

CVSS v3.1 mitre

7.1 HIGHCVSS:3.1/AC:L/AV:N/A:L/C:N/I:H/PR:L/S:U/UI:N

Published

2026-11-03

Proof-of-concept exploits (1)

• MX-Qulin/CVE-2026-106991Repo stars 0★ · pushed 2026-10-22 · find archive

CVE references

• zhblue/hustojREFERENCE
• zhblue/hustoj/pull/1192REFERENCE

References

• CVE Record
• NVD entry