FlaskBB up to 2.2.0 Bulk AJAX Endpoint improper authorization

Summaryinfo

A vulnerability classified as problematic was found in FlaskBB up to 2.2.0. The affected element is an unknown function of the component Bulk AJAX Endpoint. Executing a manipulation can lead to improper authorization. This vulnerability is tracked as CVE-2026-22660. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in FlaskBB up to 2.2.0 and classified as problematic. This vulnerability affects an unknown function of the component Bulk AJAX Endpoint. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which allows deletion of all six built-in groups and destroys the forum's permission model, potentially rendering the site unusable.

The advisory is available at github.com. This vulnerability was named CVE-2026-22660 since 01/08/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/10/2026). This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42877). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• FlaskBB

Version

• 2.0
• 2.1
• 2.2.0

Website

• Product: https://github.com/flaskbb/flaskbb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion