Vulnerability · Published Sep 30, 2026 · Assigned by VulnCheck

CVE-2026-103396bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

Medium 4.3

In plain English

A medium-severity incorrect authorization in bbs-go from mlogclub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

Affected products (as reported)

Vendor	Product	Versions
mlogclub	bbs-go	0 – through 4.4.6

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

GitHub Issue #303 issue-tracking
https://github.com/mlogclub/bbs-go/commit/97d0bb3dcbacd686fd5300295afbf4f4a5da7609 patch
https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/permissions/admin_permission_registry.go#L59-L60 technical-description
https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/handlers/admin/user_handlers.go#L47-L59 technical-description
https://github.com/mlogclub/bbs-go product
VulnCheck Advisory: bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount third-party-advisory