CVE-2026-45120 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open-source forum software that facilitates community discussions through threaded conversations, user profiles, and administrative tools. Among its various modules, the calendar feature allows users to schedule events, share dates of significance, and coordinate group activities within the platform's ecosystem. The integrity of this module relies heavily on proper access control mechanisms to ensure that sensitive or restricted information remains visible only to authorized individuals. In versions prior to 1.8.40, a significant flaw in the calendar module’s authorization logic undermined these security guarantees, creating an inconsistency between the intended private event restrictions and their actual enforcement across different functional endpoints of the application.
The core technical vulnerability stems from an incomplete implementation of access control checks within the PHP codebase responsible for handling calendar operations. Specifically, while the function get_events located in inc/functions_calendar.php correctly verifies whether a user has permission to view or moderate private events, this critical validation step was omitted in other actions defined within calendar.php. This discrepancy means that depending on which specific action is triggered by an HTTP request, the application either properly restricts access to private data or fails to do so entirely. An attacker with valid credentials who possesses viewing and moderation permissions can exploit this inconsistency by crafting requests to endpoints where the check is missing, thereby bypassing the intended privacy controls designed for private events.
This flaw represents a classic case of inconsistent authorization enforcement, often categorized under CWE-284 Improper Access Control or more specifically as an Authorization Bypass Through User-Controlled Key if the exploit relies on manipulating action parameters to hit unprotected endpoints. From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates unauthorized data access and potentially improper privilege escalation within the context of the application’s role-based permissions. It allows authenticated users to perform actions that should be restricted based on event privacy settings, effectively turning private community gatherings into public or semi-public ones without explicit consent from the event organizers.
The operational impact of this vulnerability is primarily centered around data confidentiality and user trust. Private events are typically used for sensitive planning, internal organizational meetings, or discussions involving personal information that participants expect to remain confidential within a specific group. By allowing users with moderate permissions to view these details, MyBB exposes potentially sensitive logistical information such as meeting times, locations, attendee lists, and discussion topics. This exposure can lead to privacy violations, social engineering opportunities where attackers gather intelligence on community structures, and a general erosion of trust in the platform’s ability to protect user data. For administrators relying on private events for secure coordination, this flaw renders those features unreliable until patched.
Mitigation strategies focus primarily on applying the vendor-provided software update immediately upon availability. Upgrading MyBB to version 1.8.40 or later resolves the issue by ensuring that all calendar-related actions consistently enforce access control checks against user permissions and event privacy settings. Until an upgrade is feasible, administrators should consider restricting broader moderation privileges if private events are heavily utilized, although this may impact legitimate administrative workflows. Additionally, implementing web application firewall rules to monitor for unusual patterns of requests targeting calendar endpoints with varying action parameters could provide a temporary layer of detection, though it does not fully remediate the underlying code defect. Regular security audits and static analysis tools that check for consistent authorization logic across similar functions can help prevent such discrepancies in future development cycles.