CVE-2026-103396
MediumCVSS 4.3Summary
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
Risk Assessment
An attacker could overload the server, causing service unavailability, which may lead to application disruption and financial losses.
Recommendation
Update bbs-go to a version newer than 4.4.6 if a fix is available.
Other vulnerabilities in bbs-go
See all- CVE-2023-36223Medium
A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.
- CVE-2023-36222Medium
Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.
Original NVD description (English source)
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS