CVE-2026-22659

Published: Jul 10, 2026Modified: Jul 14, 2026Deferred

7.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://github.com/flaskbb/flaskbb/commit/acc88cfedd011124395e0101cb27432a47f712be

Source: disclosure@vulncheck.com

https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/flaskbb-authorization-bypass-via-topic-id-manipulation

Source: disclosure@vulncheck.com

https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.