CVE-2026-106991
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user...
CVE-2026-106991 is a high vulnerability (CVSS 7.1), published November 3, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.
- Severity
- 7.1 HighCVSS 3.1, CVE List
- Exploit chance
- 0.37%EPSS, 31st percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | MX-Qulin/CVE-2026-106991 | 2026-10-14 |
What each source reports
CVE List Score used
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
- Record
CVE-2026-106991- CVSS 3.1
- 7.1 High
CVSS:3.1/AC:L/AV:N/A:L/C:N/I:H/PR:L/S:U/UI:N - Weakness
- CWE-284
- Updated
- 2026-11-09
EUVDEUVD-2026-115851
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
- Record
EUVD-2026-115851- CVSS 3.1
- 7.1 High
CVSS:3.1/AC:L/AV:N/A:L/C:N/I:H/PR:L/S:U/UI:N - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-w3wm-r8gq-mq7w
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user...
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
- Record
GHSA-w3wm-r8gq-mq7w- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-09
NVD
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
- Record
CVE-2026-106991- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-284
- Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| cwes | GitHub Advisories, NVD | |
| references | CVE List, EUVD, NVD | |
| facts | EUVD | |
| aliases, references, severity, title | CVE List, GitHub Advisories | |
| first indexed | EUVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.