What is the CVSS score of CVE-2026-47366?

CVE-2026-47366 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

phpBB CVE-2026-47366

EUVD-2026-36377 HIGH

Improper Access Control (CWE-284)

2026-06-12 hackerone

GHSA-f8mc-8mhv-jcrc

Authentication Bypass Privilege Escalation Phpbb

7.2

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

ACP is network-reachable (AV:N), exploitation is a single request (AC:L), requires an existing administrator account (PR:H), no user interaction, and yields full board takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 7.2

Analysis Generated

Jun 12, 2026 - 03:45 vuln.today

DescriptionCVE.org

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

AnalysisAI

Privilege escalation in phpBB allows an authenticated administrator with limited rights to grant themselves permissions beyond their authorized scope through the Administration Control Panel (ACP), enabling elevation to full administrative control over the forum. The flaw stems from improper verification of access permissions when permissions are modified via the ACP, and no public exploit identified at time of analysis. With CVSS 7.2 (PR:H) and no KEV listing, this is a meaningful but not panic-level risk that primarily threatens multi-admin phpBB deployments where administrative duties are intentionally segmented.

Technical ContextAI

phpBB is a widely deployed open-source PHP forum platform, and its Administration Control Panel exposes fine-grained role and permission management so that boards can delegate moderation or limited admin tasks without granting full ownership. The CWE-284 (Improper Access Control) root cause indicates that the ACP's permission-change handler authorizes the action based on the actor being an administrator but does not re-check whether the requesting administrator is themselves entitled to grant the specific permission being assigned, breaking the principle of least privilege. The affected CPE (cpe:2.3:a:phpbb:phpbb:*) covers the phpBB application across versions, with the specific fixed range to be confirmed from the vendor's community advisory.

RemediationAI

Upgrade to the patched phpBB release identified in the vendor announcement at https://www.phpbb.com/community/viewtopic.php?t=2672170; the exact fixed version was not included in the input data, so administrators should consult that topic for the released patched version (no patch version independently confirmed from the available data). As compensating controls until patched, restrict ACP access to a minimum number of fully trusted founders by setting other administrator accounts to the 'Standard Administrator' role rather than founder, audit the phpbb_acl_* tables and admin log for unexpected permission grants, place the /adm/ path behind HTTP basic auth or an IP allowlist at the web server so only trusted operator workstations can reach it (side effect: legitimate remote admins will need VPN or allowlist updates), and temporarily revoke a_user, a_group, and a_authusers permissions from any non-founder admin (side effect: those admins lose the ability to manage user/group permissions until the upgrade is in place).