CVE-2025-48941: MyBB Information Disclosure Vulnerability

CVE-2025-48941 Overview

CVE-2025-48941 is an information disclosure vulnerability in MyBB, an open source forum software package. Versions prior to 1.8.39 fail to validate thread visibility permissions in the search component. Attackers with basic search access can determine whether hidden threads containing specific title text exist on the forum. Affected thread states include drafts (visible = -2), soft-deleted threads (visible = -1), and unapproved threads (visible = 0). The vulnerability affects internal search queries whose result triggers a redirect response on success or a no-results message on failure. This behavior enables enumeration of hidden thread titles through response differential analysis. The issue is classified under [CWE-1230] (Exposure of Sensitive Information Through Metadata).

Critical Impact
Authenticated users can enumerate the existence of hidden, draft, unapproved, or soft-deleted thread titles through search response differential analysis, exposing moderation and administrative content metadata.

Affected Products

MyBB versions prior to 1.8.39
MyBB search component (inc/functions_search.php)
Forum installations exposing search functionality to authenticated users

Discovery Timeline

2025-06-02 - CVE-2025-48941 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48941

Vulnerability Analysis

The vulnerability resides in MyBB's search functionality within inc/functions_search.php. The search component queries the mybb_threads table without correctly filtering on the visible column for unapproved content. While MyBB validates permissions when rendering final search results, the internal query result determines whether the server issues an HTTP redirect or a no-results message. This response asymmetry acts as a boolean oracle. An attacker submits search queries with specific title text and observes the response type to infer whether matching threads exist in any visibility state. The vulnerability does not expose post message content, only the existence of threads matching title search terms. Access to the search feature and general read permission on the containing forum are the only prerequisites for exploitation.

Root Cause

The root cause is missing validation of the mybb_threads.visible integer column in the internal search query. The query included {$visiblesql} but omitted the {$unapproved_where_t} clause that enforces unapproved-content permissions. As a result, threads with visible values of -2, -1, and 0 were included in the internal result set that drove the redirect logic.

Attack Vector

Exploitation occurs over the network through the standard search interface. The attacker submits search requests with candidate title strings and observes whether the server responds with a redirect (match found) or a no-results page (no match). Iteration over targeted keywords enables enumeration of hidden thread titles.

php

		$query = $db->query("
			SELECT t.tid, t.firstpost
			FROM ".TABLE_PREFIX."threads t
-			WHERE 1=1 {$thread_datecut} {$thread_replycut} {$thread_prefixcut} {$forumin} {$thread_usersql} {$permsql} {$visiblesql} {$subject_lookin}
+			WHERE 1=1 {$thread_datecut} {$thread_replycut} {$thread_prefixcut} {$forumin} {$thread_usersql} {$permsql} {$visiblesql} AND ({$unapproved_where_t}) {$subject_lookin}
			{$limitsql}
		");
		while($thread = $db->fetch_array($query))
// Source: https://github.com/mybb/mybb/commit/b8cc332a27e145c33effaccec90e23c103ae5193

The patch adds the AND ({$unapproved_where_t}) clause to enforce visibility permission checks inside the search query itself.

Detection Methods for CVE-2025-48941

Indicators of Compromise

High volume of search requests from a single authenticated account with varied title keywords
Sequential search queries targeting incremental character variations of candidate strings
Search traffic patterns indicating automated enumeration against search.php
Requests to the search endpoint with consistent low-response-time patterns typical of scripted probing

Detection Strategies

Review MyBB web server access logs for repeated POST or GET requests to search.php from the same user session
Correlate search request volume against baseline usage per authenticated account
Alert on user accounts issuing search queries at rates inconsistent with human behavior

Monitoring Recommendations

Enable verbose HTTP access logging on the MyBB front-end web server
Track HTTP 302 redirect responses from search.php and correlate against user identity
Monitor MyBB moderator and administrator queues for evidence of external knowledge of unapproved thread titles

How to Mitigate CVE-2025-48941

Immediate Actions Required

Upgrade all MyBB installations to version 1.8.39 or later without delay
Audit administrative logs for anomalous search activity preceding the upgrade window
Review draft, unapproved, and soft-deleted threads for content whose existence is sensitive

Patch Information

MyBB released version 1.8.39 to resolve this vulnerability. The fix is documented in the MyBB 1.8.39 Release Notes and the GitHub Security Advisory GHSA-f847-57xc-ffwr. The code change is available in the upstream commit b8cc332a. The patch adds an unapproved_where_t clause to the internal thread search query in inc/functions_search.php.

Workarounds

Restrict access to the search functionality to trusted user groups until the upgrade is applied
Disable the search feature entirely through the MyBB Admin Control Panel if immediate patching is not feasible
Apply web application firewall rules that rate-limit requests to search.php per authenticated session

bash

# Verify installed MyBB version and apply update
grep -R "MYBB_VERSION" /path/to/mybb/inc/
# Download and deploy MyBB 1.8.39 from https://mybb.com/versions/1.8.39
# After upgrade, confirm the patched search query in inc/functions_search.php
grep -n "unapproved_where_t" /path/to/mybb/inc/functions_search.php