CVE-2026-106991 in Hustoj
Summary
by MITRE • 11/03/2026
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in HuShuOJ versions 24.09.10 through 26.08.19 represents a critical failure in server-side access control mechanisms within the platform's forum module. This flaw allows any authenticated user, regardless of their assigned role or privilege level, to perform administrative actions on forum threads that they do not own and should not have permission to modify. Specifically, the endpoint threadadmin.php fails to enforce proper authorization checks before processing requests intended to delete, lock, or pin sticky status to existing threads. This includes sensitive operations such as removing administrator announcements, which are typically protected by strict access controls in well-designed systems. The root cause lies in the application logic where authentication is verified but authorization is entirely neglected; the system confirms that a user is logged in but does not verify whether that specific user has the requisite permissions to execute the requested action on the target resource.
From a technical perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Control, and more specifically falls under the category of Broken Access Control as defined by OWASP Top 10 security risks. The application relies solely on session validation to grant access to administrative functions without implementing role-based or object-level permission checks. In a secure implementation, the server must validate that the requesting user possesses the necessary privileges for the specific resource being accessed. Here, the absence of such checks means that an attacker can manipulate HTTP parameters associated with thread administration endpoints to affect any thread in the database. This lack of granularity in access control allows low-privilege users to escalate their effective permissions dynamically during runtime by exploiting the unprotected administrative interface.
The operational impact of this vulnerability is severe and multifaceted, affecting both data integrity and system availability. An attacker can delete critical forum threads, including official announcements from administrators, leading to a loss of important information for other users and potentially causing confusion or misinformation within the community. Furthermore, locking threads prevents legitimate discussion on specific topics, effectively silencing user engagement and disrupting normal platform operations. The ability to set sticky status allows attackers to pin malicious content or spam to the top of forum lists, degrading the quality of discourse and potentially facilitating phishing or social engineering attacks against other users. These actions compromise the confidentiality, integrity, and availability principles essential for maintaining trust in online collaborative platforms.
Mitigation strategies must focus on implementing robust authorization checks at both the application logic level and within the database queries themselves. Developers should modify threadadmin.php to verify that the current user has explicit administrative privileges or ownership of the target thread before processing any modification requests. This involves checking session variables against a role-based access control matrix and validating resource ownership where applicable. Additionally, implementing principle of least privilege ensures that users only have access to functions necessary for their specific roles. Regular security audits and penetration testing should be conducted to identify similar gaps in other administrative endpoints. Upgrading to patched versions released after 26.08.19 is the most immediate remediation step if available, as these updates likely include fixes for this authorization bypass flaw.