CVE-2026-106991
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 03, 2026
Vendor
unknown
Description
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.