The vulnerability is a permission bypass in the AdminMiddleware authorization logic that allows authenticated users who only have read‑only view permissions to call the /api/admin/user/synccount endpoint. This endpoint triggers expensive full‑table recounts and cache invalidations, leading to a denial of service when invoked repeatedly and concurrently.

The affected product is mlogclub bbs-go version 4.4.6. No other products or versions are listed as impacted.

With a CVSS score of 5.3 the severity is moderate. The vulnerability requires authentication and only permits denial of service; it does not provide a path to privilege escalation or data exfiltration. Since the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, but any authenticated user with view rights can trigger the denial of service condition. The attack vector is through the /api/admin/user/synccount endpoint after logging in, and the impact is limited to service disruption rather than data compromise.