Medium severity4.3NVD Advisory· Published Oct 8, 2026

CVE-2026-107793

Description

Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.

Affected products

Banq/Jivejdonllm-fuzzy
Range: <=5.0
Jivejdon/jivejdonllm-fuzzy
Range: <=5.0

Patches

Vulnerability mechanics

References

github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/api/impl/subscription/SubscriptionServiceImp.javanvd
github.com/banq/jivejdon/issues/28nvd
www.vulncheck.com/advisories/jivejdon-through-5.0-idor-via-subsaveaction-subscription-deletenvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000