A logic flaw in FlaskBB up to version 2.2.0 allows an authenticated administrator to delete every built‑in authorization group. The flaw is caused by a type mismatch in the bulk delete protection check, where JSON integer group IDs are compared against string literals, causing the check to always succeed. Removing the six core permission groups collapses the forum’s permission model and can render the site unusable.

Any installation of FlaskBB released before the patch commit (a5da9a5) is affected. This includes all FlaskBB 2.2.0 and earlier releases, regardless of customizations, and affects the built‑in group structure for every site using those versions.

The CVSS score of 8.6 indicates a high severity vulnerability, and the EPSS of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the KEV catalogue, but once exploited it leads to the total removal of permission groups, effectively disabling the forum’s functionality. Attackers would succeed by sending a bulk delete request to the AJAX endpoint while authenticated as an administrator.