An authenticated administrator who logged into the phpBB Administration Control Panel was able to modify access permissions in ways that exceeded the permissions granted to their own account. This flaw in the permission verification logic allowed the attacker to grant themselves higher levels of administrative authority, effectively creating a privilege escalation vector within the web forum’s backend. The weakness aligns with Access Control Category 284, which indicates that access control checks are missing or inadequately implemented.

All phpBB installations are potentially vulnerable; the vendor’s advisory does not list specific affected versions, so any instance of phpBB that has not yet been patched should be examined for this flaw.

The vulnerability carries a CVSS score of 7.2, indicating a high risk for an authenticated user. EPSS data is not available, and the flaw has not been catalogued in CISA’s KEV list. Attackers would need legitimate administrator credentials and access to the ACP, implying a local or web-based attack surface. Once the vulnerability is exploited, the attacker can elevate permissions within the administrative interface, potentially compromising the entire forum configuration and stored data.