HUSTOJ: Incorrect access control in threadadmin.php (CVE-2026-106991)
HUSTOJ versions 24.09.10 through 26.08.19 contain an incorrect access control vulnerability in threadadmin.php that allows any registered user to modify, lock, or delete arbitrary forum threads.
CVE search metadata
CVE search record: CVE-2026-106991. Severity: high. CVSS: 7.1. KEV: no. Product: HUSTOJ (>=24.09.10 and <=26.08.19). Brief: HUSTOJ: Incorrect access control in threadadmin.php (CVE-2026-106991). Brief link: https://feed.craftedsignal.io/briefs/2026-11-hustoj-access-control/
Triage facts
Revision 1- Applicability
- HUSTOJ (>=24.09.10 and <=26.08.19)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 16:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
HUSTOJ versions 24.09.10 through 26.08.19 are vulnerable to an incorrect access control flaw in 'threadadmin.php'. The application fails to validate user permissions or authorship before performing administrative operations on forum threads. Any authenticated user can delete, lock, or pin threads, including critical administrative announcements.
Impact
Successful exploitation allows a low-privileged registered user to perform unauthorized administrative actions on the forum, potentially leading to widespread content deletion or forum disruption.
Recommendation
Inventory all HUSTOJ instances within the environment. Monitor the application for a vendor patch or security update addressing CVE-2026-106991. If a patch is unavailable, restrict public access to the HUSTOJ forum or implement temporary access controls at the web application firewall (WAF) layer to block access to 'threadadmin.php' for non-administrative user roles.
Immediate actions
Audit HUSTOJ installations to identify version numbers matching the vulnerable range
Threat Hunt
Identify unauthorized access or excessive activity targeting threadadmin.php
Data: Web server access logs
Mitigations
Block or restrict access to threadadmin.php at the WAF level for non-privileged accounts
CVE-2026-106991