hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control.

Summary

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

Remediation

1. Inventory every Unknown product deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/MX-Qulin/CVE-2026-106991
• Referencehttps://github.com/zhblue/hustoj
• Referencehttps://github.com/zhblue/hustoj/pull/1192