Description
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
Published: 2026-11-03
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Unauthorized Thread Manipulation
Action: Patch Immediately
AI Analysis

Impact

hustoj versions 24.09.10 through 26.08.19 allow any authenticated user to delete, lock, or stick forum threads via threadadmin.php because the endpoint verifies only that the user is logged in and does not check authorship or administrative privileges. This improper access control (CWE-284) lets attackers alter or remove content, potentially disrupting community discussions, defacing announcements, and compromising the integrity of user data.

Affected Systems

The vulnerability affects the hustoj forum application, specifically releases published from version 24.09.10 up to 26.08.19 inclusive.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, and the lack of EPSS data or KEV listing suggests moderate exploitation risk at this time. The attack vector is the web interface, where an attacker only needs to be a registered user, making remote exploitation straightforward under default configuration.

Generated by OpenCVE AI on November 3, 2026 at 16:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade hustoj to a version newer than 26.08.19 that contains the fix for incorrect access control.
  • If an upgrade is not immediately possible, restrict access to threadadmin.php by configuring the web server or firewall to allow requests only from trusted administrative IP addresses or enforce HTTP authentication for that endpoint.
  • Review and modify the application’s access control logic so that only users with administrative privileges can perform thread deletion, locking, or sticking operations, ensuring that authorship and role checks are enforced.

Generated by OpenCVE AI on November 3, 2026 at 16:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 15:45:00 +0000

Type Values Removed Values Added
Title Incorrect Access Control Allows Registered Users to Manipulate Forum Threads in hustoj 24.09.10–26.08.19
Weaknesses CWE-284

Tue, 03 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AC:L/AV:N/A:L/C:N/I:H/PR:L/S:U/UI:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-11-03T14:27:28.778Z

Reserved: 2026-10-07T00:00:00.000Z

Link: CVE-2026-106991

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-03T15:17:19.590

Modified: 2026-11-03T16:30:49.290

Link: CVE-2026-106991

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T16:15:13Z

Weaknesses