CVE-2026-54224

UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for other users. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/06/CVE-2026-54219
https://www.ubbcentral.com/

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) UBB.threads es vulnerable a Denegación de Servicio (DoS). Al enviar múltiples solicitudes concurrentes para ver cualquier perfil de usuario en instancias con muchos usuarios registrados, un atacante autenticado puede agotar fácilmente los recursos de la base de datos y denegar completamente el acceso a la aplicación a otros usuarios. Debido a que los intentos de contacto con el proveedor no tuvieron éxito, la vulnerabilidad solo se ha confirmado en la versión 7.7.5 pero también puede afectar a otras versiones.

Information

Published : 2026-06-18 14:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-54224

Mitre link : CVE-2026-54224

CVE.ORG link : CVE-2026-54224

JSON object : View

Products Affected

No product.

CWE

CWE-405

Asymmetric Resource Consumption (Amplification)

{"id": "CVE-2026-54224", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54224", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-18T13:09:32.994554Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "UBB Systems", "product": "UBB.threads", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.7.5"}], "defaultStatus": "unknown"}]}], "published": "2026-06-18T14:17:31.050", "references": [{"url": "https://cert.pl/en/posts/2026/06/CVE-2026-54219", "source": "cvd@cert.pl"}, {"url": "https://www.ubbcentral.com/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-405"}]}], "descriptions": [{"lang": "en", "value": "UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to view any user profile on instances with many registered users, an authenticated attacker can easily exhaust database resources and completely deny access to the application for other users.\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions."}, {"lang": "es", "value": "UBB.threads es vulnerable a Denegaci\u00f3n de Servicio (DoS). Al enviar m\u00faltiples solicitudes concurrentes para ver cualquier perfil de usuario en instancias con muchos usuarios registrados, un atacante autenticado puede agotar f\u00e1cilmente los recursos de la base de datos y denegar completamente el acceso a la aplicaci\u00f3n a otros usuarios. Debido a que los intentos de contacto con el proveedor no tuvieron \u00e9xito, la vulnerabilidad solo se ha confirmado en la versi\u00f3n 7.7.5 pero tambi\u00e9n puede afectar a otras versiones."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "cvd@cert.pl"}