CVE-2026-22659highCWE-863

CVE-2026-22659: falha de alta gravidade em flaskbb

FlaskBB Authorization Bypass via Topic ID Manipulation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar flaskbb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 0.5%
FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
flaskbb · flaskbb
CVEs relacionadas — flaskbb

No mesmo produto, das mais perigosas para as menos.

CVE-2026-22660HIGHFlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX EndpointEPSS 0.6%CVE-2026-46556MEDIUMFlaskBB: SSRF in get_image_info() via unrestricted avatar URLEPSS 0.4%