CVE-2026-103396: Mlogclub Bbs-Go

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

Affected products

• Mlogclub Bbs-Go: up to and including 4.4.6

Published 2026-09-30. Last modified 2026-09-30.