Description
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
Published: 2026-08-18
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows a user with moderator access but lacking specific report‑management permissions to mark reports as resolved. The flaw originates from an inconsistent permission check in the modcp.php handler that updates report entries, meaning the UPDATE statement can be executed without verifying the moderator’s privileges. The result is that unauthorized moderators can alter report status, potentially hiding user complaints or abuse reports, which undermines forum moderation integrity and may allow malicious or careless actions to go unreported.

Affected Systems

MyBB forum software, versions earlier than 1.8.40. The issue is fixed in the 1.8.40 release and later.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is via normal use of the moderation control panel: a moderator can submit a request to mark reports as resolved even without the necessary permission, which the application does not verify. Exploitation does not require additional prerequisites beyond possessing moderator privileges.

Generated by OpenCVE AI on August 18, 2026 at 18:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MyBB to version 1.8.40 or newer to apply the vendor fix.
  • Review moderator role permissions and ensure that canmanagereportedcontent or canmanagereportedposts are assigned only to trusted staff members.
  • Perform a security review of the moderation control panel to confirm that all actions are gated by the appropriate permission checks.

Generated by OpenCVE AI on August 18, 2026 at 18:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Mybb
Mybb mybb
Vendors & Products Mybb
Mybb mybb

Tue, 18 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
Title MyBB: Mod CP report resolution missing authorization
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Mybb Mybb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-19T14:45:32.486Z

Reserved: 2026-05-08T20:08:17.208Z

Link: CVE-2026-45124

cve-icon Vulnrichment

Updated: 2026-08-19T14:45:27.657Z

cve-icon NVD

Status : Received

Published: 2026-08-18T16:17:07.527

Modified: 2026-08-19T15:17:03.233

Link: CVE-2026-45124

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T19:00:10Z

Weaknesses