CVE-2026-45124 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
MyBB is a widely deployed open-source forum software that relies on role-based access control to manage user interactions, particularly for administrative and moderation tasks. In versions prior to 1.8.40, the Mod CP Report Center contains an authorization flaw within its report management functionality. The vulnerability stems from inconsistent permission checking logic in the handler responsible for marking selected reports as read or resolved. Specifically, the action do_reports within modcp.php checks only whether a user possesses the general canmodcp capability to access the moderator control panel. It fails to verify if the specific permissions required for managing reported content, such as canmanagereportedcontent or canmanagereportedposts, are granted to that user account. This oversight allows any moderator with basic moderation privileges to perform actions intended only for senior moderators or administrators who have explicit rights over report resolution.
The technical mechanism of this flaw involves the execution of a database update query against the mybb_reportedcontent table. When no specific forums are selected as being in scope during the operation, the variable $flist_reports remains empty. Under these conditions, the UPDATE statement executes without applying the expected permission-based limitations that would normally restrict access to users with higher-level privileges. Consequently, a moderator who lacks the authority to manage reported content can still mark reports as resolved or read by exploiting this gap in logic. This represents an authorization bypass where the application fails to enforce proper role separation for sensitive administrative actions related to community moderation workflows.
From a security classification perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically involving insufficient checks on user roles or permissions before performing critical operations. In terms of offensive tactics, this flaw facilitates unauthorized access and modification within the application layer, corresponding to ATT&CK technique T1078, Valid Accounts, as an attacker leveraging legitimate but misconfigured moderator credentials can escalate their effective privileges regarding content moderation. The operational impact includes potential abuse by lower-level moderators who might resolve reports without proper oversight, leading to inconsistent enforcement of community guidelines and potentially allowing harmful or policy-violating content to remain visible if the resolution process is manipulated incorrectly.
To mitigate this vulnerability, administrators must upgrade MyBB to version 1.8.40 or later where the permission checks have been corrected to ensure that only users with appropriate canmanagereportedcontent permissions can execute report management actions. Until an upgrade is performed, site operators should audit moderator accounts and restrict those who do not require full moderation capabilities from accessing sensitive areas of the control panel through web server configuration rules if possible. Regular review of user roles and adherence to the principle of least privilege are essential practices to prevent similar authorization bypasses in other modules of the software ecosystem.