Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

vBulletin lets remote attacker view deleted user warning

CVE-2007-2912 · published 19 years ago
Summary

If your forum runs vBulletin version earlier than 3.6.6 and the setting that blocks unauthenticated users from viewing infractions is turned off, an outside person can see a red‑flag warning that was attached to a user who has already been removed. This exposes internal moderation actions. Update vBulletin to version 3.6.6 or later, or enable the permission that restricts unauthenticated users from viewing infractions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
jelsoft vbulletin <= 3.6.4
cpe:2.3:a:jelsoft:vbulletin:*:*:*:*:*:*:*:*
Original advisory text
Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user.
Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published30 May 2007
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-2912 · NVD
Track software like this
Free during beta