Is CVE-2026-22660 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22660 being exploited in the wild.

How severe is CVE-2026-22660?

High severity, with a CVSS score of 7.2, published 10 July 2026.

Is there a fix for CVE-2026-22660?

A patch was published on 2026-05-13: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22660 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-22660?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22660: FlaskBB incorrect comparison in bulk group deletion

CVE-2026-22660 · Severity: high · CVSS 7.2 · Published 2026-07-10

FlaskBB is an open-source forum software. A security flaw allows users with administrative privileges to delete the forum's core, built-in security groups (such as Administrators and Moderators) which are normally protected. If exploited, this destroys the site's permission system and can make the forum completely unusable or inaccessible.

Quick answers

Is CVE-2026-22660 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22660 being exploited in the wild.
How severe is CVE-2026-22660?: High severity, with a CVSS score of 7.2, published 10 July 2026.
Which products and versions are affected?: flaskbb FlaskBB <= 2.2.0.
Is there a fix for CVE-2026-22660?: A patch was published on 2026-05-13: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22660 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-22660?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic flaw (CWE-697) exists in the bulk AJAX endpoint within `flaskbb/management/views.py`. The vulnerability stems from a type mismatch where the application compares integer group IDs received via JSON against a list of string literals (e.g., comparing `1` to `"1"`). Because these types do not match in Python, the intersection check intended to protect the six core built-in groups (Administrator, Super Moderator, Moderator, Member, Banned, Guest) always evaluates to false, allowing their deletion. An authenticated attacker with high privileges can send a crafted POST request to `/admin/groups/delete` to wipe the permission model. The issue is fixed in commit a5da9a5.

Affected products

flaskbb FlaskBB <= 2.2.0

Timeline

2026-05-13: patched: Fix committed to repository
2026-07-10: disclosed: Security advisory published
2026-07-10: advisory: CVE-2026-22660 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.