Jivejdon versions up to and including 5.0 contain an authorization bypass flaw that allows an authenticated user to delete another user's subscriptions via the SubscriptionServiceImp.deleteSubscription method. By submitting a delete request to /account/protected/sub/subSaveAction with the target user's subscriptionId, an attacker can remove threads, forums, tags, or account subscriptions belonging to victims. This flaw does not provide direct code execution or privilege escalation but can disrupt user experience and forum content control.

The vulnerability is present in the Banq Jivejdon platform, affecting all installations of version 5.0 and earlier. Since the source code reference points to the SubscriptionServiceImp file under those releases, any deployment of Jivejdon 5.0 or older is susceptible.

The CVSS v3.1 score of 5.3 indicates a medium impact. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting low external exploitation. Based on the description, the likely attack vector is an authenticated user with access to the Jivejdon application. An attacker can exploit this by constructing a request to /account/protected/sub/subSaveAction with a valid subscriptionId belonging to another user. The consequences are loss of user subscriptions, potential disruption of forum organization, and a degradation of user trust, but no information disclosure or remote code execution is possible.