Jivejdon CVE-2026-107793

Exploitation requires a valid authenticated Jivejdon account (any low-privileged user, per PR:L) and knowledge or enumeration of a victim's numeric subscriptionId, which is submitted as a delete action to the /account/protected/sub/subSaveAction endpoint; the SubscriptionServiceImp.deleteSubscription method performs no ownership/authorization check on the supplied ID. No user interaction from the victim and no special non-default configuration are needed - the flaw is present in the default subscription-management flow through version 5.0. Limiting factors: the attacker must be authenticated, and impact is confined to deleting subscription records (integrity only), with no confidentiality disclosure or service outage.

This is a medium-severity authorization/IDOR flaw (CWE-639) whose real-world risk is modest. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) - i.e., any authenticated user - and the impact is limited to integrity (VI:L) with no confidentiality or availability consequence to the host system. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no signal of active or probable exploitation; the only exploitation enabler is that the vulnerable logic is well-described and the source location is public (banq/jivejdon GitHub, SubscriptionServiceImp.java#L131-L146), which lowers the bar for crafting an exploit but does not constitute confirmed exploitation. Signals are internally consistent - there is no CVSS-vs-description conflict here: both agree this is an authenticated, remote, integrity-only issue. The practical ceiling of harm is deleting another user's thread/forum/tag/account subscriptions (a nuisance/data-tampering problem), not account takeover or data disclosure, so this is a genuine but low-priority fix rather than an emergency. Note the input 'Tags' label this 'Authentication Bypass', which is inaccurate: the description and CWE-639 make it an authorization (object-level access control) bypass.

An attacker registers or uses any valid Jivejdon account, then enumerates or guesses another user's subscriptionId and submits a delete action to /account/protected/sub/subSaveAction referencing that foreign ID. Because the server does not verify ownership of the supplied subscriptionId, the victim's thread, forum, tag, or account subscriptions are removed. No public POC is identified, but the exact vulnerable method and HTTP endpoint are documented, making exploitation straightforward for any authenticated user.