CVE-2026-103396

Name of the Vulnerable Software and Affected Versions bbs-go versions prior to 4.4.7

Description A permission bypass exists in the AdminMiddleware authorization logic. The read-only dashboard.user.view permission rule is matched for the '/api/admin/user/synccount' endpoint before the required dashboard.user.update rule. This allows authenticated users with only view permissions to access the '/api/admin/user/synccount' endpoint, triggering expensive full-table user recounts and cache invalidations, which can lead to a denial of service through repeated concurrent database operations.

Recommendations Update bbs-go to version 4.4.7 or later. Restrict access to the '/api/admin/user/synccount' endpoint to minimize the risk of exploitation.