Which versions of UBB.threads are affected by CVE-2026-54220?

UBB.threads forum software version 7.7.5 contains a cross-site request forgery vulnerability (CVSS 8.6) that allows attackers to trick authenticated users-including administrators-into performing…

How to fix or mitigate CVE-2026-54220?

Within 24 hours: Identify all UBB.threads 7.7.5 instances in your environment and restrict forum access to internal networks only if operationally feasible. Within 7 days: Deploy compensating controls (Content Security Policy headers, SameSite cookie attributes set to Strict) and conduct security awareness training on CSRF and phishing. Within 30 days: Contact vendor for patch availability; if no patch is released, evaluate decommissioning or replacing UBB.threads with a maintained alternative forum platform.

UBB.threads CVE-2026-54220

Q: What is the CVSS score of CVE-2026-54220?

CVE-2026-54220 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37883 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-18 CERT-PL

GHSA-f336-f4qw-pgx2

CSRF Ubb Threads Ubb Systems

8.6

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-delivered CSRF needs no attacker credentials (PR:N) but requires the victim to click/load attacker content (UI:R); impact assumes a privileged victim, giving C:H/I:H and limited A:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 13:30 vuln.today

DescriptionCVE.org

uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

AnalysisAI

Cross-site request forgery in UBB.threads forum software version 7.7.5 (and potentially earlier versions) allows remote attackers to coerce authenticated forum users - including administrators - into executing unintended state-changing actions by visiting an attacker-controlled page. The flaw was reported by CERT-PL after unsuccessful vendor contact, so no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis. The CVSS 4.0 score of 8.6 reflects high impact when an authenticated administrator is targeted, though exploitation requires active user interaction.

Technical ContextAI

UBB.threads is a long-running PHP/MySQL-based commercial bulletin-board / forum platform produced by UBB Systems (ubbcentral.com), used to host discussion communities. The root cause is CWE-352 (Cross-Site Request Forgery): state-changing HTTP endpoints in the application do not verify a per-session, per-request anti-CSRF token (or equivalent SameSite/Origin/Referer enforcement), so any authenticated session cookie is automatically attached when the victim's browser issues a request constructed by an attacker. Because forum software typically exposes privileged actions (post/edit/delete, user management, configuration changes) over authenticated POST/GET requests, the absence of these protections lets an off-site page submit those actions on the victim's behalf. The CPE cpe:2.3:a:ubb_systems:ubb.threads:*:*:*:*:*:*:*:* indicates the entire product line is in scope pending confirmation by the vendor.

RemediationAI

No vendor-released patch identified at time of analysis, as CERT-PL reports vendor contact attempts were unsuccessful - operators should monitor https://www.ubbcentral.com/ for a forthcoming release and the CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-54219 for updates. In the interim, deploy a WAF or reverse-proxy rule that rejects state-changing POST requests whose Origin or Referer header does not match the forum's own domain (trade-off: may break legitimate cross-domain integrations and some older browser/proxy setups). Set forum session cookies to SameSite=Lax or SameSite=Strict via the front-end web server if the application does not already do so (trade-off: Strict can log users out when arriving via external links). Restrict administrative endpoints by IP allow-list or HTTP basic-auth at the web-server layer so admin CSRF is impossible from arbitrary networks, and instruct administrators to log out of the forum when browsing the web and to use a dedicated browser profile for admin work. As a last-resort containment, take the forum read-only or offline until the vendor ships a fix.