{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/hustoj/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hustoj:hustoj:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-106991"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["HUSTOJ (\u003e=24.09.10 and \u003c=26.08.19)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["HUSTOJ"],"content_html":"\u003cp\u003eHUSTOJ versions 24.09.10 through 26.08.19 are vulnerable to an incorrect access control flaw in 'threadadmin.php'. The application fails to validate user permissions or authorship before performing administrative operations on forum threads. Any authenticated user can delete, lock, or pin threads, including critical administrative announcements.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged registered user to perform unauthorized administrative actions on the forum, potentially leading to widespread content deletion or forum disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eInventory all HUSTOJ instances within the environment. Monitor the application for a vendor patch or security update addressing CVE-2026-106991. If a patch is unavailable, restrict public access to the HUSTOJ forum or implement temporary access controls at the web application firewall (WAF) layer to block access to 'threadadmin.php' for non-administrative user roles.\u003c/p\u003e\n","date_modified":"2026-11-03T16:01:12Z","date_published":"2026-11-03T16:01:12Z","id":"https://feed.craftedsignal.io/briefs/2026-11-hustoj-access-control/","summary":"HUSTOJ versions 24.09.10 through 26.08.19 contain an incorrect access control vulnerability in threadadmin.php that allows any registered user to modify, lock, or delete arbitrary forum threads.","title":"HUSTOJ: Incorrect access control in threadadmin.php (CVE-2026-106991)","url":"https://feed.craftedsignal.io/briefs/2026-11-hustoj-access-control/"}],"language":"en","title":"CraftedSignal Threat Feed - HUSTOJ","version":"https://jsonfeed.org/version/1.1"}