How to fix or mitigate EUVD-2026-42878?

Within 24 hours: Identify all FlaskBB instances running version 2.2.0 or earlier and review audit logs for unauthorized topic modifications by moderators. Within 7 days: Upgrade to the latest patched version per vendor advisory. Within 30 days: Complete a review of all moderator actions during the vulnerable period and re-validate moderator permission assignments across forums.

FlaskBB EUVD-2026-42878

Q: What is the CVSS score of EUVD-2026-42878?

EUVD-2026-42878 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

Q: Which versions of FlaskBB are affected by EUVD-2026-42878?

FlaskBB versions through 2.2.0 contain an authorization bypass allowing authenticated moderators to perform unauthorized actions (delete, lock, unlock, hide) on forum topics outside their assigned…. A patch is available.

| CVE-2026-22659 HIGH

Incorrect Authorization (CWE-863)

2026-07-10 VulnCheck

Authentication Bypass Flaskbb

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable batch endpoint (AV:N/AC:L) but requires a moderator account (PR:L); no data disclosure (C:N) while topics can be altered and deleted (I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 14:02 vuln.today

DescriptionCVE.org

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.

AnalysisAI

Authorization bypass in FlaskBB through 2.2.0 lets authenticated moderators perform lock, unlock, delete, or hide actions on topics in forums they have no authority over. By anchoring a crafted batch request with a low-ID topic from a permitted forum, the attacker slips past a permission check that is applied only to the first result. No public exploit is identified at time of analysis, and the flaw is fixed in commit acc88cf.

Technical ContextAI

FlaskBB is a Python/Flask-based open-source forum (bulletin board) application, identified by CPE cpe:2.3:a:flaskbb:flaskbb, affected in all versions up to and including 2.2.0. The root cause is CWE-863 (Incorrect Authorization): the batch topic-management handler validates the moderator's permission against only the first topic resolved from a submitted list of topic IDs. Because the caller fully controls the ID list and its ordering, placing a low-ID topic from a forum the moderator legitimately controls as the 'anchor' causes the single permission check to succeed, after which the requested action is applied to every topic in the batch - including topics in forums outside the moderator's scope.

RemediationAI

Upstream fix available (commit acc88cf); a released, tagged patched version is not independently confirmed from the input, so upgrade to a FlaskBB build that includes commit acc88cfedd011124395e0101cb27432a47f712be (https://github.com/flaskbb/flaskbb/commit/acc88cfedd011124395e0101cb27432a47f712be) or later, following advisory GHSA-9rjj-9p2h-6c55 (https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55). If you cannot patch immediately, tighten and audit who holds moderator rights since exploitation requires a moderator account; consider temporarily restricting or disabling the batch/bulk topic-management actions in the moderation UI, accepting the trade-off that moderators must then act on topics one at a time; and monitor moderation logs for lock/unlock/delete/hide events touching forums a given moderator does not control so abuse can be detected and reversed.