CVE-2026-107792 — Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other u…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 4.0
Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7