Which versions of MyBB are affected by CVE-2026-58054?

MyBB 1.8.40 contains a privilege escalation flaw allowing Admin Control Panel users with delegated user-management permissions to escalate to full Administrator status, granting unrestricted system…

Is there a public PoC exploit available for CVE-2026-58054?

Yes, a public proof-of-concept exploit is available for CVE-2026-58054. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-58054?

24 hours: Audit all delegated Admin Control Panel users with user-management permissions and immediately revoke or restrict permissions for non-critical roles. 7 days: Deploy audit logging for user group modifications in ACP and block programmatic assignment of Administrators group (gid 4) through code-level or WAF-level controls. 30 days: Upgrade to patched MyBB version when released by vendor or migrate to alternative forum platform with robust permission models.

MyBB CVE-2026-58054

Q: What is the CVSS score of CVE-2026-58054?

CVE-2026-58054 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39974 HIGH

Improper Privilege Management (CWE-269)

2026-06-28 VulnCheck

GHSA-cvxv-xfvj-jmc4

Privilege Escalation Mybb

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Reachable over the network via the ACP but requires an existing privileged limited-admin account (PR:H); no user interaction, low complexity, and full takeover yields high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 02:31 vuln.today

CVSS changed

Jun 28, 2026 - 02:22 NVD

7.2 (HIGH) 8.6 (HIGH)

DescriptionCVE.org

MyBB 1.8.40 does not restrict which usergroup a limited Admin Control Panel user may assign when creating or editing users; the user module offers the Administrators group (gid 4) and its datahandler's verify_usergroup() unconditionally returns true. An admin holding only the delegated user-management permission can assign the Administrators group to an account and escalate to the full Administrator permission set.

AnalysisAI

Privilege escalation in MyBB 1.8.40 lets a limited Admin Control Panel (ACP) user who holds only the delegated user-management permission promote any account into the Administrators usergroup (gid 4), gaining the full Administrator permission set. The flaw stems from the user module exposing the Administrators group as an assignable option while the datahandler's verify_usergroup() unconditionally returns true, performing no authorization check on the target group. Publicly available exploit code exists (VulnCheck), though the issue is not listed in CISA KEV and has no public evidence of active exploitation.

Technical ContextAI

MyBB is a widely-used open-source PHP/MySQL forum platform whose Admin Control Panel supports delegated administration, where staff can be granted granular permissions (such as managing users) without being full administrators. The vulnerability is a CWE-269 Improper Privilege Management issue: when a limited admin creates or edits a user through the user module, the interface offers all usergroups including the privileged Administrators group (gid 4), and the user datahandler's verify_usergroup() validation routine returns true without checking whether the acting admin is authorized to assign that target group. The single affected product is identified by CPE cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:* with version 1.8.40 explicitly named in the description.

RemediationAI

No vendor-released patch version is identified in the available data, so monitor MyBB's official releases and the VulnCheck advisory (https://www.vulncheck.com/advisories/mybb-privilege-escalation-from-limited-acp-user-management-to-administrator) for an upstream fix and upgrade as soon as a patched 1.8.x release is published. As an immediate compensating control, audit and minimize who holds delegated user-management ACP permissions and revoke that permission from any account that does not strictly require it, since exploitation depends entirely on possessing it - the trade-off is reduced staff autonomy for user administration. Additionally, monitor the admin log for any user edits that assign the Administrators group (gid 4) and alert on unexpected promotions, and consider restricting ACP access by IP allowlist to known administrator workstations to shrink the trust surface, accepting the operational overhead of maintaining that allowlist.