Read the docs
TI-2026-18195 Aliases CVE-2026-22660

FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint

Priority HIGH 72CWE-697Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which allows deletion of all six built-in groups and destroys the forum's permission model, potentially rendering the site unusable.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00606 49th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flaskbbflaskbbup to 2.2.0—Patch availableCNA
  • flaskbb Vendorflaskbb Affected up to 2.2.0 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22660

References

Patch 1

Advisory 1

  • TI-2026-18194 FlaskBB Authorization Bypass via Topic ID Manipulation CVSS 4.0HIGH 7.2
  • TI-2026-34235 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences