External control of file name or path (CWE-73) in Citrix WorkSpace App 2607 on macOS allows a local low-privileged attacker, with active user interaction, to manipulate file system paths and cause high integrity and availability impacts on the vulnerable system. The CVSS 4.0 vector confirms local access with low privileges and required user interaction, resulting in a medium severity score of 5.2. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity and availability impacts are rated High, indicating potential for significant data manipulation or denial of service on affected endpoints.
Improper access control (CWE-284) in the custom fields webservice API of Joomla! CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 allows authenticated high-privilege users to create custom fields for components whose ACL restrictions should deny them access. The flaw represents an authorization bypass at the API layer - the REST webservice endpoints for custom fields do not enforce the same component-level ACL checks applied in the web UI, creating a privilege boundary discrepancy. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 with PR:H reflects that exploitation is constrained to already-authenticated, elevated users.
Joomla! CMS exposes a broken access control flaw on its webservices API category endpoints, permitting users who lack the requisite ACL permissions to create content categories they are explicitly not authorized to manage. The issue spans a large installed base across two major release lines: versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are confirmed affected. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the flaw is network-accessible, requires no complex conditions to trigger via the webservices interface, and was reported directly by the Joomla project.
Cross-site scripting in Joomla! CMS versions 5.1.0-5.4.7 and 6.0.0-6.1.2 exposes sites to stored XSS through improperly escaped schema.org structured-data markup output. An attacker holding high-privilege CMS credentials can inject malicious script into schema.org content fields, which subsequently executes in the browsers of users who load affected pages. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; a vendor security advisory has been issued through the Joomla Security Centre.
Stored cross-site scripting in Koha's purchase suggestion handler allows any authenticated staff user to inject persistent malicious scripts into multiple unsanitized input fields, which then execute in the browsers of other staff users who view the suggestion list. Affected versions span three active release branches: 25.05.x before 25.05.13, 25.11.x before 25.11.07, and 26.05.x before 26.05.02, all of which have now received patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects limited subsequent-system impact and the requirement for both authenticated attacker access and passive victim interaction.
Improper access control in Joomla! CMS 5.1.0-5.4.7 and 6.0.0-6.1.2 leaks restricted contact data into schema.org structured data snippets embedded in page output. The CMS fails to enforce ACL rules during schema.org contact snippet generation, allowing contact details for items that should be inaccessible to be injected into structured metadata visible in page source. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
Improper ACL enforcement in Joomla! CMS batch copy functionality allows authenticated backend users to copy content items they do not have edit permissions for, effectively bypassing content-level access controls. Affected versions span two active release branches: 4.0.0-5.4.7 and 6.0.0-6.1.2, covering a broad portion of active Joomla deployments. No public exploit code exists at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns.
Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. No public exploit is identified at time of analysis, but the CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated editor and a passive victim who views the crafted content.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
Script injection in Grav plugin-api before 1.0.15 enables authenticated users holding api.media.write permission to upload .svgz or .xhtml files that bypass the platform's SVG sanitizer, storing executable script payloads server-side. The sanitizer's incomplete extension check - recognizing only the exact string 'svg' - leaves these semantically equivalent vector/XML formats unprocessed, allowing stored cross-site scripting payloads to execute in the Grav site origin when subsequently accessed by administrators or visitors. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the mandatory low-privilege credential requirement and passive victim interaction.
Zabbix Frontend's validate.api.exists action can be exploited by authenticated, adjacent-network users to trigger disproportionate CPU consumption on the webserver, resulting in potential denial of service. All Zabbix versions are indicated as affected per vendor-supplied CPE data (cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*), and the vulnerability is rooted in CWE-405 asymmetric resource amplification. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.1 reflects the constrained blast radius imposed by the authentication and adjacent-network prerequisites.
Stored cross-site scripting in the Grav Form Plugin before version 9.1.19 allows authenticated form authors to embed persistent JavaScript payloads by supplying malicious content in field-definition properties - including prepend, append, spacer text, section text, and select option labels - which the form templates render verbatim via unescaped |raw filters and unquoted attributes. The injected script executes in every subsequent visitor's browser without any active deception required, making this a persistent, multi-victim condition for the life of the form definition. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity exploitation path and PR:L privilege requirement make this a realistic threat in any Grav deployment where form-authoring access is granted to partially trusted users.
IN_PLACE sanitization bypass in DOMPurify before 3.4.13 enables persistent cross-site scripting after sanitize() returns, affecting any application that uses DOMPurify's documented element-removal hook pattern with IN_PLACE mode enabled. When a uponSanitizeElement or beforeSanitizeElements hook removes a node via node.remove(), DOMPurify's _sanitizeElements() exits that node's processing branch without invoking _neutralizeSubtree(), leaving descendant elements - including those carrying browser-queued event handlers such as img onload - outside both the returned DOM and the DOMPurify.removed list. A working proof-of-concept targeting DOMPurify 3.4.12 under Chromium is published in the official GHSA advisory; no active exploitation is confirmed in CISA KEV at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows a low-privileged, network-accessible attacker to read a subset of application data via HTTP, with confirmed scope change indicating potential exposure of data in adjacent Oracle components. The vulnerability is tagged 'Authentication Bypass' by the reporter, suggesting the attacker can circumvent internal security controls despite holding a low-privilege account. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized access to all data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged remote attacker exploiting a flaw in the Security component over HTTP. The vulnerability results in complete confidentiality compromise - an attacker can read all data accessible to the application, including sensitive financial consolidation records. No public exploit has been identified at time of analysis, and exploitation is bounded by the requirement for high-privilege credentials, though the 'Authentication Bypass' tag suggests established access may allow security control circumvention beyond the attacker's normal authorization scope.
Arbitrary file download via path traversal in the CTX Feed WordPress plugin (versions <= 6.6.47) exposes server-side files to authenticated shop managers. The vulnerability (CWE-22) allows a WooCommerce shop manager to craft requests that traverse directory boundaries and retrieve arbitrary files - including sensitive configuration files such as wp-config.php - directly from the web server. No public exploit code or active exploitation has been identified at time of analysis, but the confidentiality impact is complete given successful exploitation.
Disk exhaustion via zip bomb bypass in MobSF prior to 4.5.1 allows any authenticated user to trigger uncontrolled resource consumption by uploading a crafted ZIP or APK whose member file exceeds 400 MB. The extraction function in shared_func.py logs a 'Skipping' warning but omits the continue statement, causing the oversized member to be written to disk regardless of the per-file size guard. A working proof-of-concept is embedded in the GitHub security advisory GHSA-x768-8642-mmq9; no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows a low-privileged network attacker to gain complete read access to all data accessible by the CAX Client component via a complex HTTP-based attack requiring victim user interaction. The vulnerability is tagged as an authentication bypass, suggesting the CAX Client component fails to enforce authorization boundaries for a subset of data operations when specific, difficult-to-reproduce conditions are met. No public exploit code or CISA KEV listing exists at time of analysis, and the high attack complexity meaningfully limits opportunistic exploitation.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables unauthenticated remote attackers to partially read and modify data within the Common Events component via HTTP under high-complexity conditions. Disclosed through Oracle's August 2026 Critical Patch Update (EUVD-2026-61525), the flaw carries a CVSS 3.1 score of 4.8 (Medium), reflecting limited impact scope and difficult exploitation prerequisites. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes an authentication bypass in its Security component that permits unauthenticated network attackers to perform limited unauthorized read and write operations on accessible financial data via HTTP. The attack is classified as difficult to exploit (AC:H), constraining realistic risk despite the absence of any authentication requirement. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Security Patch Update for August 2026.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized data access in Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated network attackers via HTTP through the Engineering Communication Interface component. The flaw - tagged as an authentication bypass - permits limited confidentiality and integrity compromise, allowing unauthorized read of a subset of accessible data and unauthorized update, insert, or delete operations on some data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity (AC:H) materially constrains real-world exploitation.
Out-of-bounds read in libmodplug through 0.8.9.1 allows a local attacker to cause the library to read one byte before the static `pat_loops` array by supplying a crafted 32-byte MIDI file to the `ModPlug_Load` entry point. The flaw in `pat_smplooped` (src/load_pat.cpp:213-217) arises because `smpno` defaults to zero and the function subtracts one before indexing the array without a lower-bound check, so a MIDI note event processed before any instrument assignment triggers `pat_loops[-1]`. The leaked byte influences loop-playback state and discloses one byte of adjacent static storage; no public exploit code or CISA KEV listing exists at time of analysis.
Local confidentiality exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with logon access to the host to access critical or complete data managed by the Hyperion platform under high-complexity conditions. The attack vector is strictly local (AV:L), requiring physical or logical access to the infrastructure host, and the high attack complexity (AC:H) significantly constrains opportunistic exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this vulnerability firmly in the insider-threat and post-compromise lateral-movement risk categories.
Integrity compromise in Oracle Hyperion Financial Reporting 11.2.25.0.000 enables a low-privileged attacker with local infrastructure access to create, delete, or modify critical financial data managed by the application. Oracle's August 2026 Critical Security Patch Update addresses the flaw, which is rated Medium severity (CVSS 4.7) and is constrained by a local attack vector and high attack complexity. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.
Local denial-of-service in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with logon access to the hosting infrastructure to hang or repeatedly crash the application via its Security component. The CVSS vector confirms this is a local, high-complexity attack with no confidentiality or integrity impact - purely an availability concern. No public exploit code and no CISA KEV listing exist at time of analysis, and the combination of local access requirement and high attack complexity substantially limits opportunistic exploitation.
Partial authentication bypass in Oracle Agile PLM MCAD Connector 3.6 exposes confidentiality and integrity of accessible PLM data to low-privileged adjacent-network attackers. The CAX Client component fails to properly restrict data operations, allowing an attacker on the same physical network segment with low-level credentials to read a subset of accessible records and perform unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the `data-trix-serialized-attributes` attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as `onerror` upon rendering. No CISA KEV listing was identified at time of analysis, but the fix PR publicly exposes a working test payload, materially lowering the barrier to exploitation.
Local exploitation of Oracle Agile PLM MCAD Connector version 3.6 enables an unauthenticated attacker with infrastructure-level logon to partially compromise the CAX Client component, resulting in limited unauthorized read, write, and denial-of-service impact. Exploitation is constrained by both high attack complexity and a mandatory human interaction requirement from a third party, making opportunistic attacks unlikely. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized confidential data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes complete application-accessible data to a network-based attacker already holding high-level privileges, exploiting a flaw within the Security component via HTTP. EUVD metadata tags this as an Authentication Bypass, suggesting an access-control enforcement failure that allows an authenticated high-privileged user to exceed authorized data boundaries rather than a perimeter bypass open to unauthenticated parties. No public exploit code has been identified, and the vulnerability has not appeared in CISA KEV at time of analysis; the high attack complexity further constrains realistic exploitation.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-accessible vulnerability in its Security component that allows a low-privileged, authenticated attacker to partially compromise data confidentiality and integrity across product boundaries via HTTP. Exploitation requires both high attack complexity and victim interaction, limiting opportunistic exploitation but not eliminating targeted risk in enterprise financial environments. No public exploit code has been identified at time of analysis, and the vulnerability is tagged as an Authentication Bypass by the reporting source, suggesting the Security component may fail to enforce authorization boundaries under specific conditions.
Unauthorized data access in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows a low-privileged, authenticated network attacker to read a subset of PeopleTools data and perform unauthorized insert, update, or delete operations via the Panel Processor component, with a confirmed scope change meaning successful exploitation can extend impact to additional dependent products. The attack carries high complexity and requires human interaction from a third-party victim. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though Oracle's tagging of 'Authentication Bypass' suggests the Panel Processor may allow privilege escalation beyond what the attacker's credential level should permit.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Denial-of-service in Oracle VM VirtualBox 7.2.14 Core component allows a high-privileged local attacker to repeatably crash or hang the hypervisor, taking down all hosted virtual machines. Exploitation requires high-privilege local logon access to the host, and Oracle's August 2026 CPU includes a fix. No public exploit code and no CISA KEV listing have been identified, keeping real-world risk limited despite the "easily exploitable" descriptor used by Oracle.
Remote code execution in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes 2.x allows a cluster administrator-or any user holding RBAC permissions to modify the Submariner Custom Resource-to reference an unvalidated, attacker-controlled container image path, causing the operator to deploy and execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes. The root cause (CWE-20: Improper Input Validation) is the absence of image path sanitization or verification before the operator acts on the Submariner CR field, enabling privilege escalation beyond the user's intended cluster boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the Changed Scope with full C:H/I:H/A:H impact ratings signal potential for complete cluster compromise once the high-privilege prerequisite is met.
Denial-of-service in libheif 1.23.0 and earlier crashes host processes when a crafted HEIF sequence file - accepted by heif_context_read_from_memory() - leaves the context with no registered sequence tracks and heif_context_get_track() is subsequently called. Debug builds abort on assert(has_sequence()) in HeifContext::get_track(); release builds reach undefined behavior by dereferencing m_tracks.begin()->second on an empty std::map, which typically causes a segfault. The flaw is reachable through documented public APIs after parsing attacker-controlled bytes, making it directly relevant to any service that processes untrusted HEIF or AVIF input. No public exploit code is identified at time of analysis, and no CISA KEV listing exists.
Skia graphics library in Google Chrome prior to 151.0.7922.169 leaks information in a way that allows remote attackers to potentially bypass the web Same-Origin Policy via a specially crafted HTML page. Affected users on all desktop platforms running any Chrome version before 151.0.7922.169 are exposed to cross-origin data disclosure triggered by visiting a malicious page. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.
File/directory key confusion in Copyparty before 1.20.17 allows an authenticated user holding a valid file key to escalate that key into a directory key, gaining unauthorized read access to the entire containing folder. The flaw stems from a missing guard in httpcli.py that unconditionally set the directory key flag even when a file key was active. Exploitation is constrained to volumes where administrators have explicitly enabled both file-key (fk or fka) and directory-key (dk or dks) volume flags simultaneously - a non-default combination - and no public exploit or active exploitation has been identified at time of analysis.
Information disclosure through Firefox's DOM Push Subscriptions component exposes limited confidential data to network-positioned attackers who can induce user interaction. All Firefox releases prior to 154 and both Firefox ESR branches (pre-140.14 and pre-153.1) are affected, with Mozilla issuing at least six security advisories (mfsa2026-74 through mfsa2026-80) addressing this and related issues. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.3 Medium rating reflects the limited scope of data exposed and the mandatory user-interaction requirement.
Information disclosure in Firefox's DOM UI Events and Focus Handling component exposes limited sensitive data to remote attackers when a victim visits a crafted web page. All Firefox releases prior to 154, ESR prior to 140.14, and ESR 153.x prior to 153.1 are affected across all platforms, as confirmed by Mozilla across six simultaneous security advisories (mfsa2026-74 through mfsa2026-80). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is moderated by the required user interaction and limited confidentiality-only impact.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
Server-side request forgery in MyBB prior to 1.8.40 allows authenticated forum users to bypass the remote host blocklist by supplying IPv6 targets, causing the application to issue unintended internal network requests. The flaw is a fail-open design: `fetch_remote_file()` skips blocklist validation entirely when `get_ip_by_hostname()` returns an empty array - which it always did for IPv6 hostnames because the resolver only extracted 'ip' keys, not 'ipv6' keys. Compounding the issue, the default disallowed host list contained no IPv6 CIDR ranges, meaning IPv6 addresses would have bypassed even a correctly functioning resolver. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Unauthorized data manipulation in Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by unauthenticated network attackers via HTTP, contingent on a victim interacting with attacker-supplied content. The vulnerability resides in the Security component and is tagged as an authentication bypass, consistent with a CSRF-like mechanism where the attacker leverages a victim's session to insert, update, or delete accessible data. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the moderate CVSS score of 4.3 reflects the integrity-only, user-interaction-dependent nature of the attack.
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.