CVE-2026-22660
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
FlaskBB through version 2.2.0 contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups. The issue is a type mismatch in the bulk AJAX endpoint, where JSON integer group IDs are compared against string literals, causing the protection check to always pass.
Risk Assessment
The risk is the potential destruction of the forum's permission model by deleting all six built-in groups, which could render the site unusable. However, the attack requires administrator authentication, limiting the threat to trusted users with high privileges.
Recommendation
Immediately update FlaskBB to a version containing commit a5da9a5 or later. If an update is not possible, temporarily restrict access to the admin panel to only trusted administrators.
Other vulnerabilities in FlaskBB
See all- CVE-2026-46556Medium
Server-Side Request Forgery (SSRF) vulnerability in FlaskBB, a forum software written in Python using Flask. Prior to version 2.2.1, the get_image_info() function allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata services. This is a blind SSRF with confirmed internal port scanning and internal API triggering capabilities.
- CVE-2026-22659High
FlaskBB through version 2.2.0 contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.
Original NVD description (English source)
FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which allows deletion of all six built-in groups and destroys the forum's permission model, potentially rendering the site unusable.