phpBB EUVD-2026-36377

Attacker must hold an authenticated administrator session on the target phpBB board with access to the Administration Control Panel permission-modification screens (CVSS PR:H), but does NOT need founder/full-admin rights - the bug is that a lower-tier administrator can grant themselves permissions beyond their authorized set. Exploitation is limited to deployments that actually delegate administration to more than one role (single-founder boards see no meaningful escalation), requires network reach to the /adm/ ACP endpoint, needs no user interaction or social engineering, and works against default phpBB ACP configurations where the permissions UI is exposed to any administrator account.

The CVSS 3.0 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 7.2 (High), driven by full CIA impact once exploited but tempered by the PR:H requirement - the attacker must already hold a high-privilege ACP account. No EPSS score, KEV listing, or public POC was supplied, and the only reference is a phpBB community forum topic rather than a CISA, NVD enrichment, or exploit-DB entry, so this currently reads as a vendor-disclosed hardening fix rather than an actively exploited bug. Real-world risk is elevated specifically for phpBB boards that practice administrative segmentation (e.g., founder vs. junior admin roles, outsourced co-admins, or community-moderator promotions), where a partially-trusted admin could trivially become a full board owner; for single-admin forums the practical impact is near-zero because the only actor with PR:H is already omnipotent.

A community board promotes a long-time moderator to a limited 'forum administrator' role intended only to manage forums and announcements; the moderator logs into the ACP, opens a permissions edit form for their own user or group, and submits a request that assigns founder-equivalent or a_* permissions that the role should not be allowed to grant, then uses the newly-acquired rights to read private messages, exfiltrate the user table, or take over the board. No public exploit identified at time of analysis, and AC:L plus UI:N indicate the action is a straightforward ACP HTTP request once the limited admin session is held.