MyBB up to 1.8.39 Calendar calendar.php permission

Summaryinfo

A vulnerability described as problematic has been identified in MyBB up to 1.8.39. This issue affects some unknown processing of the file calendar.php of the component Calendar Module. Such manipulation leads to permission. This vulnerability is uniquely identified as CVE-2026-45121. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in MyBB up to 1.8.39 and classified as problematic. Affected by this issue is an unknown code block of the file calendar.php of the component Calendar Module. The manipulation with an unknown input leads to a permission vulnerability. Using CWE to declare the problem leads to CWE-275. Impacted is confidentiality. CVE summarizes:

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-45121 since 05/08/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/18/2026). This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

By approaching the search of inurl:calendar.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.40 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 1.8.8
• 1.8.9
• 1.8.10
• 1.8.11
• 1.8.12
• 1.8.13
• 1.8.14
• 1.8.15
• 1.8.16
• 1.8.17
• 1.8.18
• 1.8.19
• 1.8.20
• 1.8.21
• 1.8.22
• 1.8.23
• 1.8.24
• 1.8.25
• 1.8.26
• 1.8.27
• 1.8.28
• 1.8.29
• 1.8.30
• 1.8.31
• 1.8.32
• 1.8.33
• 1.8.34
• 1.8.35
• 1.8.36
• 1.8.37
• 1.8.38
• 1.8.39

License

• open-source

Website

• Product: https://mybb.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion