CVE-2026-107792 Details
Description
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum.
A missing authorization vulnerability has been identified in Jivejdon versions from commit d58a36b0 through commit ee67a65e. The vulnerability resides in the 'UpdateThreadToForumAction' class, where authenticated users can move threads belonging to other users. By sending specific 'threadId' and 'forumId' values to the '/message/threadToForum/save' endpoint, an attacker can transfer any thread without replies to a chosen forum.
Users are advised to update to the latest version of Jivejdon, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| banq jivejdon | >= d58a36b0, <= ee67a65e65228644a71c8317d7e34deea50f95ef |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |