Executive Summary
CVE-2026-106991 is an incorrect access control vulnerability in hustoj, an open-source online judge system. Any registered user can delete, lock, or sticky any forum thread, including administrators' announcements, through threadadmin.php. The thread branch checks only that the user is logged in. It never verifies authorship or admin rights.
NVD published the record on 3 November 2026 with a CVSS score of 7.1 (High).
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-106991 |
| CVSS Score | 7.1 (High) |
| Type | Incorrect access control (missing authorization) |
| Component | threadadmin.php (forum thread administration) |
| Authentication | Any registered account |
| Impact | Integrity and availability of forum content |
Affected Versions
| Product | Affected Versions |
|---|---|
| hustoj | 24.09.10 through 26.08.19 |
The NVD description did not name a fixed version at the time of writing.
Impact
A low-privilege attacker can:
- Delete any thread, including administrator announcements
- Lock threads to silence discussion
- Sticky arbitrary threads to promote unwanted content
For programming contests and classrooms that rely on the forum for announcements and clarifications, this can disrupt events or enable misinformation.
Remediation
- Check the hustoj project repository for a release or commit that adds authorization checks to
threadadmin.php, and upgrade as soon as one is available. - Until patched, restrict access to
threadadmin.phpat the web server or reverse proxy, or disable open registration. - Review forum logs for unexpected delete, lock, or sticky actions by non-admin accounts.
- Keep backups of the forum database so deleted threads can be restored.