EUVD-2026-39974
GHSA-cvxv-xfvj-jmc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as limited ACP user
-
DeliveryOpen user module create/edit form
-
ExploitSelect Administrators group (gid 4)
-
Executionverify_usergroup() returns true, save
-
ImpactAccount gains full Administrator permissions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an existing authenticated MyBB Admin Control Panel account that holds the delegated user-management permission (the ability to create or edit users via the user module); this is the exact precondition reflected by PR:H in the CVSS vector. The deciding factor is that MyBB must be configured with delegated/limited admins - boards that grant ACP access only to full administrators have no lower-privileged actor to abuse, so the realistic attack surface is limited to multi-admin deployments using granular permission delegation. Beyond holding that permission, no user interaction by a victim, no special platform, and no non-default toggle are needed: the Administrators group is offered by default and verify_usergroup() always returns true. Affected version is MyBB 1.8.40. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N) scored 8.6 reflects network reachability, low complexity, no user interaction, and high impact on confidentiality, integrity, and availability - but critically requires high privileges (PR:H), meaning the attacker must already be a trusted, authenticated limited ACP admin. This is therefore an insider/trust-boundary escalation rather than an externally-reachable flaw: realistic risk is concentrated in deployments that actually use MyBB's delegated administration to grant partial ACP access to semi-trusted staff. Publicly available exploit code lowers the skill barrier, but the lack of KEV listing and the absence of an EPSS score in the input suggest no observed mass exploitation; the prerequisite of an existing privileged account inherently limits the attacker population. No EPSS value was provided, so probabilistic exploitation likelihood cannot be quantified from this data. |
| Exploit ScenarioDerived | A forum operator grants a moderator a limited ACP account with only the user-management permission to handle routine account edits. That moderator opens the user module, edits their own (or a confederate's) account, selects the Administrators group from the still-available usergroup dropdown, and saves - instantly gaining full administrator control over the board. Public exploit code for this exact path is available, making the attack trivial for anyone already holding the delegated permission. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 28, 2026
Privilege escalation in MyBB 1.8.40 lets a limited Admin Control Panel (ACP) user who holds only the delegated user-management permission promote any account into the Administrators usergroup (gid 4), gaining the full Administrator permission set. The flaw stems from the user module exposing the Administrators group as an assignable option while the datahandler's verify_usergroup() unconditionally returns true, performing no authorization check on the target group. Publicly available exploit code exists (VulnCheck), though the issue is not listed in CISA KEV and has no public evidence of active exploitation.
RemediationAI
No vendor-released patch version is identified in the available data, so monitor MyBB's official releases and the VulnCheck advisory (https://www.vulncheck.com/advisories/mybb-privilege-escalation-from-limited-acp-user-management-to-administrator) for an upstream fix and upgrade as soon as a patched 1.8.x release is published. As an immediate compensating control, audit and minimize who holds delegated user-management ACP permissions and revoke that permission from any account that does not strictly require it, since exploitation depends entirely on possessing it - the trade-off is reduced staff autonomy for user administration. Additionally, monitor the admin log for any user edits that assign the Administrators group (gid 4) and alert on unexpected promotions, and consider restricting ACP access by IP allowlist to known administrator workstations to shrink the trust surface, accepting the operational overhead of maintaining that allowlist.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MyBB is a widely-used open-source PHP/MySQL forum platform whose Admin Control Panel supports delegated administration, where staff can be granted granular permissions (such as managing users) without being full administrators. The vulnerability is a CWE-269 Improper Privilege Management issue: when a limited admin creates or edits a user through the user module, the interface offers all usergroups including the privileged Administrators group (gid 4), and the user datahandler's verify_usergroup() validation routine returns true without checking whether the acting admin is authorized to assign that target group. The single affected product is identified by CPE cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:* with version 1.8.40 explicitly named in the description.
Know when Mybb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Reachable over the network via the ACP but requires an existing privileged limited-admin account (PR:H); no user interaction, low complexity, and full takeover yields high C/I/A with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
MyBB 1.8.40 does not restrict which usergroup a limited Admin Control Panel user may assign when creating or editing users; the user module offers the Administrators group (gid 4) and its datahandler's verify_usergroup() unconditionally returns true. An admin holding only the delegated user-management permission can assign the Administrators group to an account and escalate to the full Administrator permission set.
Executive ViewAI
MyBB 1.8.40 contains a privilege escalation flaw allowing Admin Control Panel users with delegated user-management permissions to escalate to full Administrator status, granting unrestricted system access. Organizations operating MyBB with decentralized administrative roles face heightened insider threat and compromise risk, as delegated admins-whether legitimate or breached-can assume complete control without authorization checks. This risk is amplified by the absence of an available vendor patch.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Remove delegated user-management permissions from all non-essential ACP users; (2) Implement application-level authorization blocking group gid 4 assignment by delegated users; (3) Enable comprehensive logging of user group assignment attempts; (4) Enforce multi-factor authentication on all ACP accounts; (5) Restrict ACP access by IP whitelist or VPN requirement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
MyBB is a free and open source forum software. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitabl
The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration fi
SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. Rated high severity (CVSS 8.8), this vulnerabilit
SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. Rated high severity (
In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [vide
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. Rated high severity (CVSS 7.7), this
SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to ex
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. Rated h
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. Rated
An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. Rated high sever
Multiple SQL injection vulnerabilities in ajaxfs.php in the Ajax forum stat (Ajaxfs) Plugin 2.0 for MyBB (aka MyBulletin
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers
Exploit-DB