Dashboard / CVE-2026-106991

CVE-2026-106991

HIGH 1 PoC
MEDIUM Priority: 0.03 BB Relevance: 74/100
Published: 2026-11-03 Modified: 2026-11-07 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: High
A: Low

Description

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

Affected Software (2)

VendorProductVersion
n/a n/a n/a
n/a n/a n/a

References & Advisories (3)

Proof of Concept (1)

—
https://github.com/MX-Qulin/CVE-2026-106991
nomi-sec

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

7.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

EPSS — Exploitation Probability

0.41%
Raw Score 0.004120
Percentile 35.7%
Date 2026-11-07

EPSS Trend

2026-11-07
0.00412
2026-11-06
0.00412
2026-11-05
0.00412
2026-11-04
0.00412

Intelligence Sources

mitre ref →
nvd ref →

External Links