{"id":"CVE-2026-106991","kind":"vulnerability","aliases":["CVE-2026-106991"],"related":[],"title":"HUSTOJ: any registered user can delete or lock forum threads","description":"hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.","summary":"HUSTOJ, an online judge system, has an access control flaw in threadadmin.php. Any logged-in user can delete, lock, or sticky any forum thread, including administrator announcements.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hustoj","fixed":[],"affected":">= 24.09.10, <= 26.08.19","ecosystem":"other"}],"ecosystems":[],"tags":["auth-required","hustoj","online-judge","other","php","self-hosted"],"not_affected_if":["no-forum-use","registration-disabled"],"how_to_check":"- Check your HUSTOJ version: 24.09.10 through 26.08.19 is affected.\n- Open web/threadadmin.php. If it only checks that $_SESSION[...'user_id'] is set and never compares it to topic.author_id or the administrator session flag before the UPDATE topic query, you are vulnerable. The fixed file has an 'if (!isset($_SESSION[...'administrator']))' block that returns 'Permission denied.' to non-owners.\n- Whether registration is open depends on your own setup; the sources do not state the default. Also check whether the forum/discuss pages are in use.","fix":"No tagged release contains the fix. 26.08.19 (19 Aug 2026), the latest release listed, is still in the affected range. The fix is commit 9644d29 'fix threadadmin' (12 Sep 2026) in zhblue/hustoj master: non-admins may now change a thread only if their user_id matches the topic's author_id, otherwise 'Permission denied'. Until a release ships, copy trunk/web/threadadmin.php from master (or apply that commit), or restrict access to threadadmin.php.","status":"open","published_at":"2026-11-03T15:17:19+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","triaged_at":"2026-11-03T15:23:06+00:00","updated_at":"2026-11-03T15:26:39+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-03T15:23:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HUSTOJ: any registered user can delete or lock forum threads","impact":"medium","summary":"HUSTOJ, an online judge system, has an access control flaw in threadadmin.php. Any logged-in user can delete, lock, or sticky any forum thread, including administrator announcements.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hustoj","self-hosted","online-judge"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Any registered user can delete or lock any forum thread","analyst_note":"Confirm the fixed HUSTOJ version and whether registration is open by default; the sources give only the affected range.","how_to_check":"- Check the installed HUSTOJ version against the affected range `>=24.09.10` and `<=26.08.19`.\n- Look at threadadmin.php in the install and confirm whether the thread actions verify authorship or admin rights.","plain_action":"","needs_analyst":true,"not_affected_if":["registration-disabled","no-forum-use"],"who_is_affected":"Sites running HUSTOJ in the affected version range where ordinary users can register and post in the forum. The exposure comes from the thread action branch checking only that the user is logged in. Installs with registration closed or without a forum are less exposed. The sources do not say which exact version fixes it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000672,"input_tokens":4122,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed HUSTOJ version and whether registration is open by default; the sources give only the affected range.","search":"'-106991':13A,16A '-2026':12A,15A '24.09.10':59C '26.08.19':61C 'access':37B,66C 'admin':80C,93C 'administr':56B 'announc':57B,81C 'auth':19B 'auth-requir':18B 'authorship':91C 'branch':86C 'control':38B,67C 'cve':11A,14A 'delet':6A,48B,72C 'flaw':39B 'forum':9A,53B,77C 'host':29B 'hustoj':1A,17A,21B,30B,58C 'includ':55B,79C 'incorrect':65C 'judg':24B,33B 'lock':8A,49B,73C 'log':44B 'logged-in':43B 'login':89C 'never':90C 'onlin':23B,32B 'online-judg':22B 'php':26B 'regist':3A,69C 'requir':20B 'right':94C 'self':28B 'self-host':27B 'sticki':51B,75C 'system':34B 'thread':10A,54B,78C,85C 'threadadmin.php':41B,83C 'user':4A,46B,70C 'verifi':88C 'via':82C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted HUSTOJ online judge sites running 24.09.10 through 26.08.19 where ordinary users can hold an account. Any logged-in user can delete, lock or pin any forum thread, including administrators' announcements, by calling threadadmin.php. Sites that disable registration and only have trusted accounts, or do not use the forum, are much less exposed.","tier":"B","verified":{"fix":{"at":"2026-11-03T15:26:39Z","by":"analyst","doc":"https://github.com/zhblue/hustoj/commit/9644d29ede9f6295486cbd9c1fb21b414a99c1ef","run_id":1500}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hustoj"],"ptokens":["hustoj"],"labels":["authrequired","high","hustoj","onlinejudge","other","php","selfhosted"],"first_public_at":"2026-11-03T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"cve@mitre.org","poc_count":2,"sources":[{"source":"nvd","external_id":"CVE-2026-106991","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106991","severity":null,"published_at":"2026-11-03T15:17:19+00:00","modified_at":"2026-11-03T15:17:19+00:00","first_seen_at":"2026-11-03T15:21:56+00:00","fetched_at":"2026-11-03T15:21:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106991:1500","url":null,"severity":null,"published_at":"2026-11-03T15:26:39+00:00","modified_at":"2026-11-03T15:26:39+00:00","first_seen_at":"2026-11-03T15:26:39+00:00","fetched_at":"2026-11-03T15:26:39+00:00","note":"Affected range from NVD and Packet Storm. Fix read in zhblue/hustoj master threadadmin.php and commit 9644d29 (12 Sep 2026, by the reporter MX-Qulin); no release after 26.08.19 seen, so no fixed version number exists. Public PoC repo MX-Qulin/CVE-2026-106991 (pocindex, Packet Storm 237292). No exploitation reports found. Default registration setting not confirmed. No GHSA found."}],"documents":[{"id":58440,"url":"https://github.com/zhblue/hustoj/commit/9644d29ede9f6295486cbd9c1fb21b414a99c1ef","title":"fix threadadmin (9644d29), zhblue/hustoj","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":58441,"url":"https://github.com/zhblue/hustoj/releases","title":"Releases, zhblue/hustoj (latest 26.08.19)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":58442,"url":"https://vulners.com/packetstorm/PACKETSTORM:237292","title":"HUSTOJ 26.08.19 Thread Moderation Authorization Bypass (Packet Storm, MX-Qulin)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":58443,"url":"https://pocindex.io/CVE-2026-106991","title":"PoC Index: MX-Qulin/CVE-2026-106991","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}