Type Mismatch Enables Unauthorized Authorization Group Deletion

CVE-2026-22660 represents a critical logic flaw in FlaskBB's bulk delete protection mechanism that allows authenticated administrators to bypass authorization controls. The vulnerability stems from a type mismatch in the bulk AJAX endpoint where integer group IDs from JSON requests are compared against string literals, causing the protection check to systematically fail. This enables deletion of all six built-in authorization groups, completely destroying the forum's permission model. Any administrator account—even those with limited intended privileges—can exploit this to render the entire authorization framework non-functional, creating a cascading privilege escalation scenario where default permissions collapse. This affects all FlaskBB deployments through version 2.2.0 and represents a high-severity risk (CVSS 7.2) because it requires only authenticated access but results in complete loss of access controls.

Casky's 754 security skills mapped to MITRE ATT&CK would detect the attack patterns underlying this CVE through extended reasoning analysis of authorization logic flows. While this specific CVE currently maps to zero matching skills due to its novel type-confusion pattern, Casky's Claude-powered detection would identify the core attack chain: an authenticated user (valid credentials, MITRE T1078) exploiting improper input validation (CWE-697) to achieve privilege escalation and persistence through authorization bypass. Practitioners using Casky would observe findings related to suspicious bulk deletion requests with type mismatches in validation logs, anomalous group permission changes affecting multiple built-in groups simultaneously, and access control enforcement failures. The platform would flag the JSON integer-to-string comparison logic as a detection gap, prompting practitioners to audit bulk management endpoints for similar type-safety issues and implement strict authorization group immutability protections.