The flaw in UBB.threads allows an authenticated attacker to trigger a denial of service by flooding the application with simultaneous requests to view user profiles. Each request forces the backend to perform a database query, and when many requests are served concurrently the database subsystem can run out of resources, bringing the site to a halt for legitimate users. The issue is confirmed on version 7.7.5, though the root cause might still be present in other releases.

UBB Systems UBB.threads is vulnerable. The full‑featured version 7.7.5 is confirmed to be affected, and other, as yet unvalidated, releases may also be at risk.

The CVSS score of 7.1 places the condition in the high‑severity range. No EPSS score is published, and the flaw is not yet listed in the CISA KEV catalog, indicating no publicly confirmed exploitation yet. Because the attack requires an authenticated user view of profiles and hinges on high concurrency, an attacker would need to hold valid credentials or compromise a legitimate account. The denial‑of‑service impact can disrupt all application users if the database resources are consumed completely. The lack of a known public exploit suggests that a vulnerability‑specific exploit may not yet exist but could be constructed by a skilled attacker who can orchestrate many concurrent profile‑view requests.