Permission Bypass in bbs-go AdminMiddleware Related to User Dashboard Access
CVE-2026-103396

5.3MEDIUM

Key Information:

Vendor

Mlogclub

Status
Bbs-go
Vendor
CVE Published:
30 September 2026

What is CVE-2026-103396?

The bbs-go application versions prior to 4.4.6 are susceptible to a permission bypass vulnerability within the AdminMiddleware authorization logic. Specifically, the dashboard.user.view permission can erroneously match the /api/admin/user/synccount endpoint, allowing authenticated users with only view permissions to execute costly full-table user recount operations and cache invalidations. This behavior can be exploited to create a denial of service by initiating repeated concurrent database transactions, thereby overwhelming the system.

Affected Version(s)

bbs-go 0 <= 4.4.6

References

https://github.com/mlogclub/bbs-go/issues/303
issue-tracking
https://github.com/mlogclub/bbs-go/commit/97d0bb3dcbacd68...
patch
https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/p...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.