# CVE-2026-103396: bbs-go permission bypass in AdminMiddleware authorization

Source: https://junglewise.ai/threats/cve-2026-103396-bbs-go-through-4-4-6-contains-a-permission-bypass-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103396 · Severity: medium · CVSS 4.3 · Published 2026-09-30

bbs-go is a lightweight community and forum platform. Authenticated users with read-only dashboard permissions can bypass authorization checks and call an administrative endpoint that triggers expensive database operations, allowing them to cause denial of service by overloading the system with repeated requests.

Technologies: [Mlogclub Bbs-Go](https://junglewise.ai/threats/technologies/bbs-go). Vendors: [Mlogclub](https://junglewise.ai/threats/vendors/mlogclub).

## Quick answers

**Is CVE-2026-103396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103396 being exploited in the wild.

**How severe is CVE-2026-103396?** Medium severity, with a CVSS score of 4.3, published 30 September 2026.

**Which products and versions are affected?** Mlogclub Bbs-Go through 4.4.6.

**Is there a fix for CVE-2026-103396?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103396 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103396?** Check whether you run Mlogclub Bbs-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A permission bypass exists in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule, due to incorrect rule ordering. Authenticated users with view-only permissions can invoke the synccount endpoint to trigger full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

## Affected products

- mlogclub bbs-go through 4.4.6

## Timeline

- 2026-09-30: disclosed

## References

- [https://github.com/mlogclub/bbs-go](https://github.com/mlogclub/bbs-go)
- [https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/handlers/admin/user_handlers.go](https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/handlers/admin/user_handlers.go)

## Related threats

- [bbs-go improper certificate validation in SMTP](https://junglewise.ai/threats/cve-2026-121452-bbs-go-through-4-4-6-contains-an-improper-certificate-validation)
- [bbs-go authentication bypass in Google One Tap](https://junglewise.ai/threats/cve-2026-111639-bbs-go-through-4-4-6-contains-an-authentication-bypass)
- [bbs-go stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-110103-bbs-go-through-4-4-6-contains-a-stored-cross-site-scripting)