CVE-2026-22659 Details
Description
FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.
An authorization bypass vulnerability has been identified in FlaskBB versions through 2.2.0. This vulnerability allows authenticated moderators to perform unauthorized actions on topics in forums they do not manage, by sending crafted lists of topic IDs. The issue arises because permission checks are only applied to the first topic in a batch request. Moderators can exploit this by including a low-ID topic from a forum they control, thereby bypassing authorization for higher-ID topics in restricted forums. As a result, they can lock, unlock, delete, or hide topics in unmoderated forums.
Users can update to FlaskBB version 2.2.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55 | CISA-ADP | AdvisoryTechnical DescriptionVendor |
| https://github.com/flaskbb/flaskbb/commit/acc88cfedd011124395e0101cb27432a47f712be | [email protected] | Source CodeVendor |
| https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55 | [email protected] | AdvisoryTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/flaskbb-authorization-bypass-via-topic-id-manipulation | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FlaskBB | <= 2.2.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |