CVE-2026-54224 Details
Description
UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for other users. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.
A denial-of-service vulnerability has been identified in UBB.threads version 7.7.5, although it may affect other versions. This vulnerability allows an authenticated attacker to exhaust database resources by sending multiple concurrent requests to view user profiles on instances with a large number of registered users. As a result, the application becomes inaccessible to other users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2026/06/CVE-2026-54219 | [email protected] | AdvisoryBundleRemedy |
| https://www.ubbcentral.com/ | [email protected] | Content WallVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-405 | Asymmetric Resource Consumption (Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| UBB Systems UBB.threads | <= 7.7.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | New CVE Received | [email protected] |
| Jun 18, 2026 | CVE Modified | CISA-ADP |