Vulnerabilidades do Mlogclub Bbs-go

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Mlogclub Bbs-go: 3 registro(s), com versões afetadas e correções.

CVE-2026-111639 Alta · 8.1 CWE-287 16/10/2026

bbs-go through 4.4.6 Account Takeover via Google One Tap Login

bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can capture a victim's Google-signed ID token and replay it, since the aud claim is never checked, to obtain an authenticated session as the victim's Google-linked account.

CVE-2026-110103 Média · 5.4 CWE-79 13/10/2026

bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type

bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.

CVE-2026-103396 Média · 4.3 CWE-863 30/09/2026

bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.