hustoj forum lets any registered user delete, lock, or sticky threads

Anyone who signed up can delete posts on this programming problem site's forum.

Summary

hustoj's thread handler checks only login, not authorship or admin rights, so any registered user can delete, lock, or sticky any forum thread, including admin announcements. Versions >=24.09.10 and <=26.08.19 are affected.

Affected when

Registered user account with login
hustoj >=24.09.10 and <=26.08.19

What to do

Check that the product runs a version newer than 26.08.19, and read the vendor's advisory. No fixed version is named in the sources.

Products and platforms

hustoj

CVE IDs

CVE-2026-106991 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)
Repository: github.com (opens in a new tab)

Times

First published 2026-11-03 00:00 UTC

First seen 2026-11-09 14:10 UTC