CVE-2026-45124

Received Received - Intake

Permission Bypass in MyBB Mod CP Report Center

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-45124

EUVD

EUVD-2026-61018

Affected Vendors & Products

Vendor	Product	Version / Range
mybb	mybb	1.8.40

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in MyBB forum software (before version 1.8.40) allows moderators without proper report-management permissions to mark reports as resolved. The Mod CP Report Center incorrectly permits access to the report resolution function even when the moderator lacks necessary permissions. This occurs because the system fails to enforce permission checks when no forums are in scope.

Detection Guidance

This vulnerability can be detected by checking the MyBB version installed on your system. If the version is below 1.8.40, the system is vulnerable. You can check the version by running commands like 'grep -r "MyBB" /path/to/your/installation' or checking the footer of your forum.

Impact Analysis

If exploited, this vulnerability could allow unauthorized moderators to improperly resolve reports, potentially hiding legitimate issues or concerns. This undermines forum moderation integrity and may lead to unresolved problems persisting without oversight.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves unauthorized moderator actions in a forum system rather than data breaches or privacy violations. However, if moderators without proper permissions mark reports as resolved, it could lead to unaddressed issues like harassment or policy violations going unnoticed, potentially impacting organizational accountability.

Mitigation Strategies

Immediately upgrade MyBB to version 1.8.40 or later to address the vulnerability. Ensure that moderators have the correct permissions configured to prevent unauthorized actions in the Mod CP Report Center.

Hi! I’m here to help you understand CVE-2026-45124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70