EUVD-2026-95349
GHSA-j6vx-2fc6-j9pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege forum user
-
ExploitCraft POST to /message/threadToForum/save with victim threadId and target forumId
-
ExecutionMissing authorization check in UpdateThreadToForumAction bypassed
-
ImpactVictim's reply-less thread relocated to arbitrary forum
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a valid authenticated account on the target Jivejdon instance (PR:L - any registered user, no admin role needed) and (2) the target thread being reply-less, since the UpdateThreadToForumAction move operation only applies to threads without replies. The attacker must know or enumerate a valid victim threadId and a destination forumId. No user interaction and no special server configuration are required - the missing authorization check in UpdateThreadToForumAction is present in default behavior across commits d58a36b0 through ee67a65e. Limiting factors: the account prerequisite, the reply-less-thread constraint, and the fact that impact is confined to thread relocation (integrity), bounding real-world severity well below a critical remote flaw. |
| Impact | This is a genuine but modest-severity issue, not a top priority. The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) confirms a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) - i.e. any registered forum user - with only limited integrity impact (VI:L) and no confidentiality or availability impact, consistent with the 5.3 (Medium) score. The weakness is CWE-862 (missing authorization), reported by VulnCheck with a corresponding advisory and GitHub issue, so the vulnerability itself is well-documented. However, no EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical blast radius is narrow: an attacker can only relocate reply-less threads between forums - a data-integrity/nuisance issue rather than code execution or data theft. Net assessment: real and valid, but low operational urgency, further limited by Jivejdon's small real-world footprint. |
| Exploit ScenarioDerived | A registered user of a Jivejdon forum authenticates normally, then sends a crafted POST to /message/threadToForum/save supplying another user's threadId along with an arbitrary forumId. Because UpdateThreadToForumAction never checks ownership, the server moves that victim's reply-less thread into the attacker-chosen forum. No public exploit code is identified at time of analysis, but the HTTP-based attack is trivial to reproduce from the public source and advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) lets any authenticated user relocate another user's forum thread into an arbitrary forum by submitting crafted threadId and forumId values to /message/threadToForum/save. The flaw stems from an absent ownership or role check in the action handler (CWE-862), and it is constrained in practice because only threads with no replies can be moved and the attacker must already hold a valid account, so impact is limited to integrity (thread relocation) with no confidentiality or availability loss and a CVSS 5.3 / CVSS:3.1 5.3 rating. There is no public exploit identified at time of analysis and no confirmed active exploitation, so this is a modest-severity issue rather than an urgent one.
RemediationAI
No vendor-released patch was identified at time of analysis; the affected commit range d58a36b0 through ee67a65e is documented in https://github.com/banq/jivejdon/issues/28 and the VulnCheck advisory https://www.vulncheck.com/advisories/jivejdon-through-commit-ee67a65e-missing-authorization-via-message-threadtoforum-save-thread-move, so tracking that issue and deploying a build beyond commit ee67a65e is the primary path. Until a fixed build is confirmed, apply targeted compensating controls: add an authorization check to UpdateThreadToForumAction (or a Struts interceptor) that verifies the requesting user owns the thread or holds a moderator/admin role before any thread-to-forum move is persisted - this is the most direct fix, but it requires code changes and regression testing of forum move functionality. Alternatively, restrict the /message/threadToForum/save endpoint at the reverse proxy or servlet filter so that only trusted moderator accounts can reach it; the trade-off is that legitimate self-service thread moves by ordinary users will break. Restricting or disabling open self-registration reduces the pool of accounts an attacker needs to exploit the flaw, at the cost of community growth, and tightening registration review is a weaker but low-effort control. Audit and log thread-move operations, alerting on moves performed by accounts that are not the thread author, to detect abuse; this offers no prevention but gives detection coverage. Because the flaw only affects reply-less threads, moderators can also monitor reply-less thread placement for unexpected relocations as a lightweight backstop, acknowledging this does not stop the attack itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Jivejdon is a Java-based forum/discussion application built on the Struts framework, identified by the affected CPE cpe:2.3:a:banq:jivejdon:*:*:*:*:*:*:*:* (a wildcard that covers all published versions of the banq:jivejdon product). The vulnerable code path is the Struts action class com.jdon.jivejdon.presentation.action.message.UpdateThreadToForumAction (lines 25-62 of the file at commit ee67a65e), which is mapped in application/WEB-INF/struts-config-message.xml (lines 136-140) to the /message/threadToForum/save endpoint. The root cause class is CWE-862 (Missing Authorization): the action performs the thread-to-forum move based solely on attacker-controlled threadId and forumId parameters, without verifying that the requesting user owns the thread or holds a moderator/administrator privilege. The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) and the independently assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) both describe a low-privilege, network-reachable integrity-only issue: PR:L confirms the attacker must be authenticated (any registered user, no elevated role), and the VI:L / I:L metrics confirm the sole effect is unauthorized modification of thread placement, not data disclosure or denial of service. The operation applies only to reply-less threads, which further bounds the reachable impact.
Know when Jivejdon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network endpoint with low complexity; PR:L because any authenticated user suffices; integrity-only (I:L) since threads can be moved, no confidentiality or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted throu
Missing rate limiting in Jivejdon's unauthenticated /account/smsVRAction endpoint allows remote attackers to send unlimi
SQL injection in Jivejdon through 5.0 allows an authenticated user with the Admin role to read arbitrary database conten
Authentication bypass in Jivejdon through 5.0 allows remote attackers to log in as any user whose account was created th
Authenticated users can delete other users' subscriptions in Jivejdon through 5.0 by sending a delete action with a vict
Reflected cross-site scripting in Jivejdon from commit 5489372d through ee67a65e allows unauthenticated remote attackers
Reflected cross-site scripting in Jivejdon through 5.0 lets an attacker execute arbitrary JavaScript in an authenticated
Cross-site request forgery in Jivejdon through 5.0 allows unauthenticated attackers to trick authenticated users into de
Stored cross-site scripting in Jivejdon through 5.0 allows an authenticated user to embed script inside a private short
Stored cross-site scripting in Jivejdon through 5.0 lets an authenticated, upload-capable user store an attachment whose
Stored cross-site scripting in Jivejdon through 5.0 allows any authenticated forum user to inject JavaScript into a thre
Stored cross-site scripting in the JiveJdon forum platform (banq/jivejdon) from commit 595d8d22 through commit ee67a65e
Exploit-DB