HustOJ CVE-2026-106991

Requires a valid authenticated session on the HustOJ instance (PR:L) - any registered user, with no authorship or administrator role needed, which is the entire defect. The attacker invokes the thread-management actions in threadadmin.php (delete/lock/sticky) against an arbitrary thread ID. No non-default configuration, user interaction, or special platform is required beyond having an account; the main limiting factor is how account registration is controlled - on instances with open self-registration this is effectively unauthenticated-adjacent, whereas instances that gate account creation raise the bar. Affected versions are HustOJ >=24.09.10 through <=26.08.19.

This is a genuine, moderately serious authorization flaw rather than an inflated high-CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) is internally consistent with the description and with the fix: PR:L reflects that any authenticated account is sufficient, AC:L reflects that no special timing or configuration is needed, and I:H reflects that an attacker can destroy or lock any thread, including administrators' announcements. The practical severity hinges on how accounts are provisioned - on public online-judge deployments self-registration is typically open, which effectively lowers the authentication barrier toward trivial. The source-code evidence (PR #1192) directly confirms the mechanism: the pre-patch check passed whenever a user_id OR administrator session existed, so any logged-in user reached the admin action; the patch adds an author/owner check against the topic table. No EPSS score and no KEV listing were supplied, so widespread or confirmed active exploitation cannot be asserted; the vuln.today decision label is 'this_week' (not act_now/emergency). A third-party repository (MX-Qulin/CVE-2026-106991) is referenced and appears to be a PoC, but the input does not confirm it as working exploit code. Net: a real, promptly-fixable priority for anyone running an affected HustOJ instance, but not an emergency on the supplied signals.

An attacker registers an ordinary account on a HustOJ instance (or uses any existing low-privilege login) and issues a request to threadadmin.php targeting a thread ID - for example an administrator's pinned announcement - to delete, lock, or sticky it. Because the thread branch only checks that a session is logged in and never verifies authorship or admin rights, the action succeeds. A public PoC reference exists (MX-Qulin/CVE-2026-106991); it is not verified as working exploit code in the available data.