CVE-2026-45122 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in MyBB versions prior to 1.8.40 represents a critical failure in access control logic within the forum software's calendar module. Specifically, the flaw resides in the do_move action handler located in the calendar.php script. When an administrator or moderator attempts to relocate a calendar event from one calendar container to another, the system performs validation checks on the source calendar but fails to verify permissions for the destination calendar. This oversight allows any user who possesses moderation privileges for the originating calendar to bypass access controls and move events into calendars where they are granted only viewing rights. The core technical deficiency is the absence of a canmoderateevents check against the target calendar object during the transition process, creating a clear path for privilege escalation relative to data manipulation capabilities within restricted areas of the forum structure.
From an operational perspective, this vulnerability enables unauthorized modification and relocation of content that should be protected by role-based access controls. While the attacker may not have direct write permissions on the destination calendar, they can effectively alter its contents by moving events into it without proper authorization. This undermines the integrity of the moderation workflow and compromises the confidentiality and availability aspects of data management within those restricted calendars. For instance, sensitive announcements or scheduled maintenance notices intended for specific groups could be moved to public-facing calendars where unauthorized users might view them, leading to information disclosure. Conversely, legitimate events in private forums could be displaced into public spaces, disrupting community organization and potentially causing confusion among members who rely on accurate scheduling information.
This issue aligns with CWE-269, which describes Improper Privilege Assignment, as the application fails to enforce appropriate access levels for different user roles during a state-changing operation. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of using legitimate credentials and permissions to perform actions outside their intended scope through logic flaws rather than credential theft or exploitation of authentication bypasses. The vulnerability highlights how relying on partial validation checks can lead to significant security gaps even when basic permission structures are correctly defined for individual resources independently.
The recommended mitigation is straightforward and has already been implemented by the MyBB development team in version 1.8.40. Administrators running older versions must upgrade immediately to patch this logic error. Until upgrading is possible, there are no effective workarounds since the flaw exists within the core application code rather than configuration settings. Organizations should also review their calendar structures and moderation policies to ensure that any future updates or customizations do not reintroduce similar permission validation gaps in other modules where resource movement or modification occurs across different access boundaries. Regular security audits of role-based permissions are essential to maintain robust access control frameworks within web applications like MyBB.