---
id: "CVE-2026-106991"
kind: "vulnerability"
aliases: ["CVE-2026-106991"]
title: "HUSTOJ: any registered user can delete or lock forum threads"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "hustoj", "fixed": [], "affected": ">= 24.09.10, <= 26.08.19", "ecosystem": "other"}]
ecosystems: []
tags: ["auth-required", "hustoj", "online-judge", "other", "php", "self-hosted"]
not_affected_if: ["no-forum-use", "registration-disabled"]
published_at: "2026-11-03T15:17:19+00:00"
first_seen_at: "2026-11-03T15:21:56+00:00"
updated_at: "2026-11-03T15:26:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106991", "first_seen_at": "2026-11-03T15:21:56+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T15:26:39+00:00"}]
---

# HUSTOJ: any registered user can delete or lock forum threads

HUSTOJ, an online judge system, has an access control flaw in threadadmin.php. Any logged-in user can delete, lock, or sticky any forum thread, including administrator announcements.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:hustoj affected >= 24.09.10, <= 26.08.19 fixed ?

## How to check

- Check your HUSTOJ version: 24.09.10 through 26.08.19 is affected.
- Open web/threadadmin.php. If it only checks that $_SESSION[...'user_id'] is set and never compares it to topic.author_id or the administrator session flag before the UPDATE topic query, you are vulnerable. The fixed file has an 'if (!isset($_SESSION[...'administrator']))' block that returns 'Permission denied.' to non-owners.
- Whether registration is open depends on your own setup; the sources do not state the default. Also check whether the forum/discuss pages are in use.

## Fix

No tagged release contains the fix. 26.08.19 (19 Aug 2026), the latest release listed, is still in the affected range. The fix is commit 9644d29 'fix threadadmin' (12 Sep 2026) in zhblue/hustoj master: non-admins may now change a thread only if their user_id matches the topic's author_id, otherwise 'Permission denied'. Until a release ships, copy trunk/web/threadadmin.php from master (or apply that commit), or restrict access to threadadmin.php.

## Timeline

- 2026-11-03T15:21:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106991
- 2026-11-03T15:26:39+00:00 analyst — Affected range from NVD and Packet Storm. Fix read in zhblue/hustoj master threadadmin.php and commit 9644d29 (12 Sep 2026, by the reporter MX-Qulin); no release after 26.08.19 seen, so no fixed version number exists. Public PoC repo MX-Qulin/CVE-2026-106991 (pocindex, Packet Storm 237292). No exploitation reports found. Default registration setting not confirmed. No GHSA found.

## Documents

- [fix] fix threadadmin (9644d29), zhblue/hustoj https://github.com/zhblue/hustoj/commit/9644d29ede9f6295486cbd9c1fb21b414a99c1ef
- [mentions] Releases, zhblue/hustoj (latest 26.08.19) https://github.com/zhblue/hustoj/releases
- [poc] HUSTOJ 26.08.19 Thread Moderation Authorization Bypass (Packet Storm, MX-Qulin) https://vulners.com/packetstorm/PACKETSTORM:237292
- [poc] PoC Index: MX-Qulin/CVE-2026-106991 https://pocindex.io/CVE-2026-106991

## From the sources

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_