Executive brief
MyBB, a popular open-source forum software, contains a flaw in its administrative control panel. A staff member with limited permissions (specifically only the ability to manage users) can grant themselves or others full Administrator status. This allows a restricted user to bypass their limitations and gain complete control over the forum, including the ability to modify site settings, access sensitive data, and delete content.
Technical details
A privilege escalation vulnerability exists in MyBB 1.8.40 due to improper privilege management in the Admin Control Panel (ACP) user module. The software fails to restrict which usergroups a delegated administrator can assign when creating or editing accounts. Specifically, the user module's datahandler contains a `verify_usergroup()` function that unconditionally returns true, allowing the assignment of the 'Administrators' group (GID 4). An attacker with existing ACP access and 'user-users' permissions can exploit this to grant themselves or a new account full administrative rights, bypassing intended permission restrictions. A Python-based proof-of-concept has been developed to demonstrate this escalation.
Affected products
- MyBB MyBB <= 1.8.40
Timeline
- 2026-05-28: other: MyBB 1.8.40 released
- 2026-06-27: advisory: VulnCheck advisory published
- 2026-06-28: disclosed: CVE published to NVD