CVE-2026-107793: Authorization Bypass Through User-Controlled Key in banq jivejdon

CVE-2026-107793 is an authorization bypass vulnerability in banq's Jivejdon product through version 5.0. The issue exists in the SubscriptionServiceImp.deleteSubscription method, where the system fails to properly verify ownership of the subscription ID provided by an authenticated user. As a result, an attacker can submit a delete action to the /account/protected/sub/subSaveAction endpoint with a subscriptionId belonging to another user, causing unauthorized deletion of that user's subscriptions.

An authenticated user can delete other users' subscriptions, potentially disrupting their access to threads, forums, tags, or account subscriptions. This could lead to denial of service or loss of subscription data for affected users. The vulnerability does not allow privilege escalation or remote unauthenticated access but does compromise subscription integrity among authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the subscription deletion functionality to trusted users only and monitor for suspicious deletion activities. Implement additional authorization checks to ensure users can only delete their own subscriptions.