FlaskBB implements batch operations on topics through a list of IDs. An authenticated moderator can craft a list that begins with a low‑ID topic from a forum the moderator is allowed to manage. Because the authorization check is performed only on the first ID, the subsequent topics—potentially from forums the moderator does not control—are processed without permission verification. This flaw allows the attacker to lock, unlock, delete, or hide topics, undermining both integrity and availability of forum data. The vulnerability is a classic example of CWE‑863, unauthorized privilege escalation through improper authorization checks.

FlaskBB versions up to and including 2.2.0 are vulnerable. The fix is incorporated in commit acc88cfedd011124395e0101cb27432a47f712be. The vulnerability originates from the topic management endpoint that processes batch topic operations.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid moderator credentials and the ability to submit a crafted batch request, making the attack vector an authenticated application‑layer exploit. If reached, the attacker could alter or remove content in forums beyond their authorized scope, degrading trust and service continuity.