# CVE-2026-22659: FlaskBB authorization bypass in batch topic actions

Source: https://junglewise.ai/threats/cve-2026-22659-flaskbb-authorization-bypass-in-batch-topic-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-22659 · Severity: high · CVSS 8.1 · Published 2026-07-10

FlaskBB, an open-source forum software, contains a security flaw that allows forum moderators to perform administrative actions on discussions they are not authorized to manage. By manipulating a list of discussion IDs, a moderator can bypass permission checks to lock, unlock, hide, or delete topics in forums outside of their control. This could lead to unauthorized content removal or disruption of service across the entire community platform.

## Quick answers

**Is CVE-2026-22659 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22659 being exploited in the wild.

**How severe is CVE-2026-22659?** High severity, with a CVSS score of 8.1, published 10 July 2026.

**Which products and versions are affected?** flaskbb FlaskBB <= 2.2.0.

**Is there a fix for CVE-2026-22659?** A patch was published on 2026-07-10: Fix committed in acc88cf Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22659 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-22659?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass (CWE-863) exists in FlaskBB's batch topic processing logic within `flaskbb/utils/helpers.py`. The `do_topic_action` function only validates the permissions of the first topic in a provided list of IDs. Because the application fetches topics from the database and processes them in ID order, an attacker with moderator privileges in at least one forum can include a low-ID 'anchor' topic from their permitted forum at the start of a batch request. This causes the initial permission check to pass, subsequently applying the requested action (lock, unlock, delete, or hide) to all other topics in the list, even those residing in forums where the moderator has no authority. The issue is fixed in commit acc88cf by ensuring all topics in a batch belong to the same forum.

## Affected products

- flaskbb FlaskBB <= 2.2.0

## Timeline

- 2026-07-10: advisory: GHSA-9rjj-9p2h-6c55 published
- 2026-07-10: patched: Fix committed in acc88cf

## References

- [https://github.com/flaskbb/flaskbb/commit/acc88cfedd011124395e0101cb27432a47f712be](https://github.com/flaskbb/flaskbb/commit/acc88cfedd011124395e0101cb27432a47f712be)
- [https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55](https://github.com/flaskbb/flaskbb/security/advisories/GHSA-9rjj-9p2h-6c55)
- [https://www.vulncheck.com/advisories/flaskbb-authorization-bypass-via-topic-id-manipulation](https://www.vulncheck.com/advisories/flaskbb-authorization-bypass-via-topic-id-manipulation)