EUVD-2026-61018Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Mod CP is web-accessible requiring only a moderator credential (PR:L); no confidentiality or availability impact, solely limited report-status integrity modification.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
AnalysisAI
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general canmodcp permission to mark reported content as resolved, regardless of whether they hold the specific canmanagereportedcontent or canmanagereportedposts capability. The bypass is triggered via the modcp.php?action=do_reports handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the $flist_reports variable is empty and the SQL UPDATE against mybb_reportedcontent fires without the expected permission-based WHERE clause. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MyBB account with the `canmodcp` permission granted but without `canmanagereportedcontent` or `canmanagereportedposts` - a moderator deliberately scoped to other functions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately characterizes this as a low-medium severity issue: the attack vector is network-accessible, complexity is low, but exploitation requires an existing low-privileged moderator account and produces only a limited integrity impact - no data can be read or deleted, only report status altered. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MyBB 1.8.40, which resolves the issue by inserting an explicit `canmanagereportedcontent` permission check and a non-super-moderator `numreportedposts` guard in the `do_reports` handler (commit 5cda5f6d183bc2cac24f0533e8d3060a9a46cc42). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today