HUSTOJ - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/hustoj/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 16:01:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHUSTOJ: Incorrect access control in threadadmin.php (CVE-2026-106991)https://feed.craftedsignal.io/briefs/2026-11-hustoj-access-control/Tue, 03 Nov 2026 16:01:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-hustoj-access-control/HUSTOJ versions 24.09.10 through 26.08.19 contain an incorrect access control vulnerability in threadadmin.php that allows any registered user to modify, lock, or delete arbitrary forum threads.HUSTOJ versions 24.09.10 through 26.08.19 are vulnerable to an incorrect access control flaw in 'threadadmin.php'. The application fails to validate user permissions or authorship before performing administrative operations on forum threads. Any authenticated user can delete, lock, or pin threads, including critical administrative announcements.

Impact

Successful exploitation allows a low-privileged registered user to perform unauthorized administrative actions on the forum, potentially leading to widespread content deletion or forum disruption.

Recommendation

Inventory all HUSTOJ instances within the environment. Monitor the application for a vendor patch or security update addressing CVE-2026-106991. If a patch is unavailable, restrict public access to the HUSTOJ forum or implement temporary access controls at the web application firewall (WAF) layer to block access to 'threadadmin.php' for non-administrative user roles.

]]>highadvisory