The vulnerability exists in the UpdateThreadToForumAction handler, where an authorization check is omitted. Authenticated users can send crafted threadId and forumId values to the /message/threadToForum/save endpoint and move reply‑less threads belonging to other users into any forum. The primary impact is that attackers can relocate user content without permission, potentially causing confusion, breaking editorial workflows, or hiding posts. This flaw is categorized as CWE‑862 – Missing Authorization.

Jivejdon, versions from commit d58a36b0 up to ee67a65e. The affected vendor is banq, and the product is Jivejdon.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploits yet. Attackers only need a valid authenticated session; no special privileges or advanced techniques are required beyond normal account usage. The risk remains moderate, but if high‑volume migrations or sensitive content are involved, the asset may be more valuable to target.