bbs-go CVE-2026-103396

Requires an authenticated bbs-go admin-dashboard account that holds at least the read-only dashboard.user.view permission; because the view rule pattern is evaluated before the update rule, such an account can reach the /api/admin/user/synccount endpoint that should require dashboard.user.update. Exploitation is limited to bbs-go versions through 4.4.6, needs no user interaction, and its impact is confined to availability degradation (expensive recounts/cache invalidation) - there is no path to confidentiality or integrity loss. The need for valid low-privilege admin credentials is the primary limiting factor; a fully anonymous attacker cannot trigger it.

This is a genuine but low-severity authorization flaw whose real-world risk is modest. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L, base 5.3) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated account (PR:L) and yielding only an availability impact (VA:L) with no confidentiality or integrity loss. CWE-863 (Incorrect Authorization) accurately captures the root cause - a permission-rule ordering bug where the read-only dashboard.user.view pattern shadows the intended dashboard.user.update rule for the /api/admin/user/synccount endpoint. There is no EPSS score, no CISA KEV listing, and no published exploit code in the input (the GitHub issue #303 and VulnCheck advisory document the flaw but are not weaponized PoCs), so there is no public exploit identified at time of analysis. The impact ceiling is a resource-exhaustion/DoS via repeated expensive full-table recounts and cache invalidations, not code execution or data theft. No signals conflict; the one caveat is that exploitation still needs a valid admin-panel account holding at least view-level permissions, which meaningfully narrows the attacker population. Combined with the product's small deployment footprint, this is a low-priority, defense-in-depth fix rather than an emergency.

An attacker who holds a limited bbs-go admin account with only read-only user-view permissions (e.g., a low-trust staff member or a compromised low-privilege dashboard credential) repeatedly and concurrently calls the /api/admin/user/synccount endpoint. Each call forces an expensive full-table user recount and cache invalidation, and sustained concurrent requests degrade database performance and site availability. No public exploit code is required - the request is a simple authenticated API call.