hustoj versions from 24.09.10 through 26.08.19 contain an incorrect access control vulnerability. This flaw allows any registered user to delete, lock, or sticky any forum thread, including those restricted to administrators, due to insufficient verification of user rights in threadadmin.php.