Incorrect access control in hustoj lets users change any forum thread
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
hustoj versions 24.09.10 up to and including 26.08.19 are affected. The thread branch of threadadmin.php only checks that the user is logged in, not authorship or admin rights, so any registered user can delete, lock, or sticky any forum thread, including admin announcements. An attacker needs only a low-privilege registered account and network access.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for hustoj.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-03 Threatist record created from CVE-2026-106991
- 2026-11-03 Alias added: GHSA-w3wm-r8gq-mq7w
- 2026-11-05 Priority changed: MEDIUM → LOW
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-106991 · CVE Program
- CVE-2026-106991 · NVD
- FIRST EPSS
- GHSA-w3wm-r8gq-mq7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences