CyberRota Analysis
AI-GeneratedFlaskBB versions up to 2.2.0 are vulnerable to an authorization bypass that enables authenticated moderators to manipulate topics in forums outside their control by exploiting crafted topic ID lists. This flaw allows unauthorized actions such as locking, unlocking, deleting, or hiding topics, posing a significant risk to forum integrity. Organizations using FlaskBB should prioritize patching this vulnerability to prevent potential abuse by malicious moderators.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.