Executive brief
A security flaw in the phpBB forum software allows an existing administrator to grant themselves additional high-level permissions they should not have access to. This could allow a junior administrator to gain full control over the forum's settings, user data, and system configuration. This vulnerability undermines the internal security controls meant to limit what different staff members can do within the management console.
Technical details
A privilege escalation vulnerability exists in the phpBB Administration Control Panel (ACP) due to improper access control (CWE-284). The root cause is a failure to properly verify the current administrator's authorization level when they are modifying permission sets. An attacker with existing high-privilege (administrator) access can exploit this over the network to grant themselves or others permissions exceeding their intended scope. This allows for a vertical privilege escalation within the administrative interface, potentially leading to full compromise of the application's integrity and confidentiality. The issue was disclosed via HackerOne and affects the ACP component.
Affected products
- phpBB phpBB
Timeline
- 2026-06-12: disclosed: Initial publication of the CVE record.