# CVE-2026-22660: FlaskBB incorrect comparison in bulk group deletion

Source: https://junglewise.ai/threats/cve-2026-22660-flaskbb-incorrect-comparison-in-bulk-group-deletion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-22660 · Severity: high · CVSS 7.2 · Published 2026-07-10

FlaskBB is an open-source forum software. A security flaw allows users with administrative privileges to delete the forum's core, built-in security groups (such as Administrators and Moderators) which are normally protected. If exploited, this destroys the site's permission system and can make the forum completely unusable or inaccessible.

## Quick answers

**Is CVE-2026-22660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22660 being exploited in the wild.

**How severe is CVE-2026-22660?** High severity, with a CVSS score of 7.2, published 10 July 2026.

**Which products and versions are affected?** flaskbb FlaskBB <= 2.2.0.

**Is there a fix for CVE-2026-22660?** A patch was published on 2026-05-13: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22660 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-22660?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A logic flaw (CWE-697) exists in the bulk AJAX endpoint within `flaskbb/management/views.py`. The vulnerability stems from a type mismatch where the application compares integer group IDs received via JSON against a list of string literals (e.g., comparing `1` to `"1"`). Because these types do not match in Python, the intersection check intended to protect the six core built-in groups (Administrator, Super Moderator, Moderator, Member, Banned, Guest) always evaluates to false, allowing their deletion. An authenticated attacker with high privileges can send a crafted POST request to `/admin/groups/delete` to wipe the permission model. The issue is fixed in commit a5da9a5.

## Affected products

- flaskbb FlaskBB <= 2.2.0

## Timeline

- 2026-05-13: patched: Fix committed to repository
- 2026-07-10: disclosed: Security advisory published
- 2026-07-10: advisory: CVE-2026-22660 published

## References

- [https://github.com/flaskbb/flaskbb/commit/a5da9a529adddc65fe31e275192b642a4e32de64](https://github.com/flaskbb/flaskbb/commit/a5da9a529adddc65fe31e275192b642a4e32de64)
- [https://github.com/flaskbb/flaskbb/security/advisories/GHSA-r9cf-jxr6-5h3r](https://github.com/flaskbb/flaskbb/security/advisories/GHSA-r9cf-jxr6-5h3r)
- [https://www.vulncheck.com/advisories/flaskbb-logic-flaw-authorization-group-deletion-via-bulk-ajax-endpoint](https://www.vulncheck.com/advisories/flaskbb-logic-flaw-authorization-group-deletion-via-bulk-ajax-endpoint)