What is the CVSS score of EUVD-2026-61053?

EUVD-2026-61053 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-61053?

Yes, a patch is available for EUVD-2026-61053. Update the affected software to the latest version immediately.

MyBB EUVD-2026-61053

| CVE-2026-45121 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-18 GitHub_M

PHP Authentication Bypass Mybb

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L reflects mandatory authenticated session; C:L captures calendar title-only disclosure; I:N and A:N are correct as no data modification or service disruption occurs.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 18, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 18, 2026 - 16:52 vuln.today

Analysis Generated

Aug 18, 2026 - 16:52 vuln.today

DescriptionCVE.org

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40.

AnalysisAI

Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated MyBB forum account, consistent with CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.3 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately reflects the constrained impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to MyBB 1.8.40, which corrects both vulnerable code paths in calendar.php by replacing the incorrect $calendar['cid'] variable reference with $calendar_option['cid'] and adding the missing canmoderateevents enforcement. … Detailed patch versions, workarounds, and compensating controls in full report.