Live › vulnerability › CVE-2026-106991
HUSTOJ, an online judge system, has an access control flaw in threadadmin.php. Any logged-in user can delete, lock, or sticky any forum thread, including administrator announcements.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Self-hosted HUSTOJ online judge sites running 24.09.10 through 26.08.19 where ordinary users can hold an account. Any logged-in user can delete, lock or pin any forum thread, including administrators' announcements, by calling threadadmin.php. Sites that disable registration and only have trusted accounts, or do not use the forum, are much less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| hustoj | other | >= 24.09.10, <= 26.08.19 | – |
26.08.19 (19 Aug 2026), the latest release listed, is still in the affected rangefix threadadmin (12 Sep 2026) in zhblue/hustoj master: non-admins may now change a thread only if their user_id matches the topics author_id, otherwise Permission denied'Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.
This page as .md · .json · in your agent: get_signal("CVE-2026-106991")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.