Executive brief
FlaskBB is an open-source forum software. A security flaw allows users with administrative privileges to delete the forum's core, built-in security groups (such as Administrators and Moderators) which are normally protected. If exploited, this destroys the site's permission system and can make the forum completely unusable or inaccessible.
Technical details
A logic flaw (CWE-697) exists in the bulk AJAX endpoint within `flaskbb/management/views.py`. The vulnerability stems from a type mismatch where the application compares integer group IDs received via JSON against a list of string literals (e.g., comparing `1` to `"1"`). Because these types do not match in Python, the intersection check intended to protect the six core built-in groups (Administrator, Super Moderator, Moderator, Member, Banned, Guest) always evaluates to false, allowing their deletion. An authenticated attacker with high privileges can send a crafted POST request to `/admin/groups/delete` to wipe the permission model. The issue is fixed in commit a5da9a5.
Affected products
- flaskbb FlaskBB <= 2.2.0
Timeline
- 2026-05-13: patched: Fix committed to repository
- 2026-07-10: disclosed: Security advisory published
- 2026-07-10: advisory: CVE-2026-22660 published