Executive brief
FlaskBB, an open-source forum software, contains a security flaw that allows forum moderators to perform administrative actions on discussions they are not authorized to manage. By manipulating a list of discussion IDs, a moderator can bypass permission checks to lock, unlock, hide, or delete topics in forums outside of their control. This could lead to unauthorized content removal or disruption of service across the entire community platform.
Technical details
An authorization bypass (CWE-863) exists in FlaskBB's batch topic processing logic within `flaskbb/utils/helpers.py`. The `do_topic_action` function only validates the permissions of the first topic in a provided list of IDs. Because the application fetches topics from the database and processes them in ID order, an attacker with moderator privileges in at least one forum can include a low-ID 'anchor' topic from their permitted forum at the start of a batch request. This causes the initial permission check to pass, subsequently applying the requested action (lock, unlock, delete, or hide) to all other topics in the list, even those residing in forums where the moderator has no authority. The issue is fixed in commit acc88cf by ensuring all topics in a batch belong to the same forum.
Affected products
- flaskbb FlaskBB <= 2.2.0
Timeline
- 2026-07-10: advisory: GHSA-9rjj-9p2h-6c55 published
- 2026-07-10: patched: Fix committed in acc88cf