EUVD-2026-37887
GHSA-r4cc-xcx2-vp28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity abuse of a normal feature by any authenticated user, no UI; only availability is affected (database exhaustion), no confidentiality or integrity impact.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for other users. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.
AnalysisAI
Database-resource exhaustion in UBB.threads forum software (confirmed in version 7.7.5) allows an authenticated low-privileged user to deny service to the entire application by issuing concurrent profile-view requests. The flaw, reported by CERT-PL and tracked as CWE-405 (Asymmetric Resource Consumption), produces high availability impact (CVSS 4.0 VA:H, 7.1) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the vulnerability is not on the CISA KEV list.
Technical ContextAI
UBB.threads (Unified Bulletin Board) is a long-running PHP-based discussion forum platform maintained by UBB Systems and identified by the CPE cpe:2.3:a:ubb_systems:ubb.threads. The weakness maps to CWE-405 (Asymmetric Resource Consumption / Amplification), in which a relatively cheap client request triggers disproportionately expensive backend work - here, rendering an individual user-profile page evidently issues database queries whose cost scales with the total number of registered users (likely unbounded JOINs, COUNTs of posts/threads, or missing indexes). When many such requests are dispatched concurrently, the database server becomes the choke point, blocking every other forum request behind it.
RemediationAI
No vendor-released patch identified at time of analysis - vendor contact attempts by CERT-PL were unsuccessful, so operators must apply compensating controls. Immediately rate-limit requests to the user-profile endpoint (e.g., via nginx limit_req or a WAF rule keyed on session/IP) to cap concurrent profile views per user, accepting that legitimate rapid browsing will occasionally be throttled. Add database query timeouts and consider caching the rendered profile output (Varnish, Redis, or a reverse-proxy cache) so repeat views do not re-execute the expensive queries, at the cost of slightly stale post-counts. As a more disruptive option, restrict profile viewing to authenticated long-standing accounts or require a CAPTCHA before profile rendering, which breaks the easy concurrency abuse but hurts community usability. Monitor the CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-54219 and the vendor site https://www.ubbcentral.com/ for any future fixed release.
More in Ubb Threads
View allCross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attacke
Remote code execution in UBB.threads forum software (version 7.7.5 confirmed) is achievable by authenticated users holdi
Authenticated blind SQL injection in UBB.threads forum software version 7.7.5 (and likely other versions) allows adminis
Cross-site request forgery in UBB.threads forum software version 7.7.5 (and potentially earlier versions) allows remote
Reflected XSS in UBB.threads 7.7.5 enables remote attackers to execute arbitrary JavaScript in a victim's browser by tri
Stored XSS in UBB.threads 7.7.5 permits low-privileged forum members to permanently inject arbitrary JavaScript into pos
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today