Missing authorization in Jivejdon lets users move others' threads
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Jivejdon from commit d58a36b0 through commit ee67a65e is affected. A missing authorization check (CWE-862) in UpdateThreadToForumAction lets authenticated users move threads they do not own. An attacker can send crafted threadId and forumId values to the thread save endpoint to relocate any reply-less thread into an arbitrary forum.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for Jivejdon.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107792
- 2026-10-13 CISA SSVC decision points changed
References
Other 4
- GitHub Issue #28
- https://github.com/banq/jivejdon
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/presentation/action/message/UpdateThreadToForumAction.java#L25-L62
- https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/application/WEB-INF/struts-config-message.xml#L136-L140
More banq vulnerabilities
- TI-2026-69782 Jivejdon SMS endpoint lacks rate limiting, allowing unlimited texts CVSS 4.0MEDIUM 6.9
- TI-2026-69780 Predictable passwords in Jivejdon Sina Weibo OAuth login CVSS 4.0MEDIUM 6.9
- TI-2026-69781 Unsalted MD5 password storage in Jivejdon CVSS 4.0HIGH 8.2
- TI-2026-69775 Reflected cross-site scripting in Jivejdon postThread.jsp CVSS 4.0MEDIUM 5.3
- TI-2025-43894 SQL injection in Jivejdon user list lets administrators read data CVSS 4.0MEDIUM 6.9
- TI-2026-69774 Reflected cross-site scripting in Jivejdon taggedThreadList.jsp CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences