Is CVE-2026-106991 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-106991?

CVE-2026-106991 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-106991

Description

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.