EUVD-2026-42877Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated admin (PR:H) over the network via a single AJAX call (AC:L); impact is data destruction and site outage (I:H/A:H) with no confidentiality loss (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which allows deletion of all six built-in groups and destroys the forum's permission model, potentially rendering the site unusable.
AnalysisAI
Authorization-model destruction in FlaskBB forum software (versions up to and including 2.2.0) lets an authenticated administrator wipe all six built-in permission groups through the management bulk-delete AJAX endpoint. Because the endpoint compares JSON integer group IDs against string literals, the guard meant to protect built-in groups never matches and silently allows their removal, collapsing the forum's entire permission model and potentially bricking the site. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in commit a5da9a5.
Technical ContextAI
FlaskBB is a Python/Flask-based open-source forum engine whose access control depends on six built-in authorization groups (e.g. Administrator, Moderator, Member, Banned, Guest). The management views expose a bulk-delete AJAX endpoint that receives a JSON payload of group IDs. Per CWE-697 (Incorrect Comparison), the protection routine that is supposed to reject deletion of reserved built-in groups compares the incoming values - deserialized as JSON integers - against hard-coded string literals. Because Python treats an int and a string of the same digits as unequal (1 != '1'), the equality test always evaluates false, the 'this is a protected group' branch is never taken, and every group ID passes the check and is deleted. The affected component is identified in CPE data as cpe:2.3:a:flaskbb:flaskbb:*:*:*:*:*:*:*:* across all versions through 2.2.0.
RemediationAI
Upgrade FlaskBB to a build containing the upstream fix - the patch is available in commit a5da9a5 (https://github.com/flaskbb/flaskbb/commit/a5da9a529adddc65fe31e275192b642a4e32de64); this is an upstream commit fix, so a released patched version is not independently confirmed from the provided data and operators tracking 2.2.0 should pull the patched commit or the next tagged release above 2.2.0. Until patched, restrict administrator accounts aggressively: enforce strong/MFA-backed authentication on admin logins and minimize the number of admin-privileged users, since the flaw is only reachable with admin rights. As a targeted compensating control, block or restrict access to the group bulk-delete AJAX endpoint in the management views at a reverse proxy or WAF layer (trade-off: legitimate bulk group management via the UI will break), and maintain tested database backups of the group/permission tables so the built-in groups can be restored if deleted. Refer to advisory GHSA-r9cf-jxr6-5h3r for authoritative guidance.
Same weakness CWE-697 – Incorrect Comparison
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today