Vendor
HUSTOJ versions 24.09.10 through 26.08.19 contain an incorrect access control vulnerability in threadadmin.php that allows any registered user to modify, lock, or delete arbitrary forum threads.