CVE-2026-22659

Name of the Vulnerable Software and Affected Versions FlaskBB versions prior to 2.2.1

Description An authorization bypass allows authenticated moderators to perform unauthorized actions on topics in forums they do not control. By submitting crafted topic ID lists in a batch request, an attacker can use a low-ID topic from a permitted forum as an anchor. This causes the permission check, which is only applied to the first result, to pass, enabling the execution of lock, unlock, delete, or hide actions against topics in unmoderated forums.

Recommendations Update FlaskBB to version 2.2.1 or later.