Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107793Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in jivejdon from banq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.

Affected products (as reported)

Vendor	Product	Versions
banq	jivejdon	0 – through 5.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Issue #28 issue-tracking
https://github.com/banq/jivejdon product
https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/api/impl/subscription/SubscriptionServiceImp.java#L131-L146 technical-description
VulnCheck Advisory: Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete third-party-advisory