CVE-2026-45121 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open-source forum software that facilitates community discussions through threaded conversations, user profiles, and administrative tools. Among its various modules, the calendar feature allows users to view events, birthdays, and scheduled activities associated with specific forums or groups. This functionality relies on strict permission checks to ensure that only authorized members can access sensitive information within restricted areas of the forum. The integrity of these permissions is critical for maintaining data confidentiality and preventing unauthorized disclosure of community structures.
A significant vulnerability was identified in the calendar module prior to version 1.8.40, specifically involving inconsistent permission validation when listing calendars. The flaw resides in the code paths within calendar.php that handle the retrieval of calendar titles. In these specific execution contexts, the application performs permission checks against an invalid or null calendar context rather than the actual target resource. This logical error means that while the system may correctly restrict access to viewing full event details for restricted calendars, it fails to apply equivalent restrictions when merely listing the names or titles of those calendars. Consequently, authenticated users can retrieve metadata about private forums or groups by inspecting the list of available calendar entries, even if they lack explicit permission to view content within those spaces.
This vulnerability is classified as an Inconsistent Interpretation of Security Constraints and falls under CWE-284 Improper Access Control. From a threat modeling perspective, this behavior aligns with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to access resources they are not authorized to view. Although the vulnerability requires authentication, it enables information disclosure that can aid in further reconnaissance activities. An attacker could use the exposed calendar titles to map out the internal structure of a forum, identifying private communities or restricted groups based on their naming conventions and activity levels visible through the calendar interface.
The operational impact of this flaw is primarily informational rather than directly exploitable for code execution or data exfiltration in its current form. However, it compromises the confidentiality aspect of security by leaking metadata about protected resources. For administrators relying on MyBB to host private communities, such as corporate internal forums or sensitive support channels, this leak undermines trust and privacy expectations. It allows malicious insiders or compromised accounts to gather intelligence that could facilitate targeted social engineering attacks or further privilege escalation attempts if other vulnerabilities exist in conjunction with this information leakage.
The issue has been resolved in MyBB version 1.8.40 by correcting the permission logic within calendar.php. The fix ensures that all paths involving calendar selection and listing perform rigorous access control checks against the correct, valid calendar context before returning any data to the user. Administrators running affected versions should upgrade immediately to patch this inconsistency. Additionally, it is recommended to review server logs for signs of automated scanning targeting the calendar module endpoints, as attackers may have exploited this flaw prior to widespread adoption of the patched version. Regular updates and adherence to security best practices remain essential for maintaining a secure forum environment.