CVE-2026-45120: MyBB Calendar Auth Bypass Vulnerability

CVE-2026-45120 Overview

CVE-2026-45120 is an authorization flaw in MyBB, an open source forum software package. Versions prior to 1.8.40 fail to consistently verify private event status in the calendar module. Users with viewing and moderation permissions can access and moderate private calendar events they should not see.

The root cause resides in inc/functions_calendar.php, where the private-event check inside get_events() and the event action is absent from remaining actions in calendar.php. This contradicts the limited-access behavior documented in inc/languages/english/calendar.lang.php. The issue is classified as [CWE-639] Authorization Bypass Through User-Controlled Key and is resolved in MyBB 1.8.40.

Critical Impact
Authenticated forum users can read and moderate private calendar events belonging to other users, resulting in confidentiality and integrity loss on personal event data.

Affected Products

MyBB forum software versions prior to 1.8.40
MyBB calendar.php module actions other than event
MyBB inc/functions_calendar.phpget_events() function callers

Discovery Timeline

2026-08-18 - CVE-2026-45120 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45120

Vulnerability Analysis

The MyBB calendar module supports private events that should only be visible to their creator. The private flag enforcement lives inside get_events() in inc/functions_calendar.php and the event action in calendar.php. Other calendar actions retrieve event records directly using the caller-supplied eid parameter without re-checking the private column against the requesting user's UID.

An authenticated user with normal calendar viewing permissions can supply an arbitrary eid and receive the event contents. Users holding calendar moderation permissions can additionally invoke moderation actions on those private events. The disclosed data may include event titles, descriptions, and scheduling information intended only for the creator.

Root Cause

The defect is a missing authorization check on a user-controlled object identifier, matching the [CWE-639] pattern. The application enforces access control in some code paths but omits the same check in adjacent handlers that operate on the same resource. The calendar.lang.php language file references limited-access semantics that the codebase does not uniformly implement.

Attack Vector

Exploitation requires an authenticated forum account with calendar viewing or moderation privileges. The attacker submits a crafted request to a vulnerable calendar.php action referencing the target eid. No user interaction from the victim is required, and the attack executes over the network against the forum web application.

php

// Security patch in calendar.php - MyBB 1.8.40
// Fix: Insufficient authorization for private calendar events (CVE-2026-45120)
	$query = $db->simple_select("events", "*", "eid='{$mybb->input['eid']}'");
	$event = $db->fetch_array($query);
 
-	if(!$event)
+	if(!$event || ($event['private'] == 1 && $event['uid'] != $mybb->user['uid']))
 	{
 		error($lang->error_invalidevent);
 	}

Source: GitHub Commit c077e6c. The patch extends the existing invalid-event guard to also reject requests where the record is marked private and the requesting user is not the event owner.

Detection Methods for CVE-2026-45120

Indicators of Compromise

Requests to calendar.php with eid parameters that do not correspond to events owned by, or shared with, the requesting user's UID.
Moderation actions (edit, delete, approve) performed against event records where the private column equals 1 and uid does not match the acting moderator.
Sequential enumeration of the eid parameter across calendar.php actions from a single authenticated session.

Detection Strategies

Review MyBB web server access logs for calendar.php requests containing action values other than event combined with numeric eid iteration patterns.
Correlate authenticated session identifiers with the events table to identify accesses to rows where private = 1 by non-owners.
Alert on MyBB moderator log entries referencing calendar events whose owning UID differs from the acting moderator's UID.

Monitoring Recommendations

Enable MyBB moderator action logging and forward records to a centralized log store for retention and query.
Monitor for MyBB installations still reporting versions below 1.8.40 through the admin CP version banner or HTTP response fingerprints.
Track anomalous request volumes to calendar.php from individual authenticated users, particularly outside normal forum usage patterns.

How to Mitigate CVE-2026-45120

Immediate Actions Required

Upgrade MyBB installations to version 1.8.40 or later, which contains the authorization check in calendar.php.
Audit the mybb_events table and moderator action logs for accesses to private events by users other than the owner during the exposure window.
Review calendar moderator permission assignments and remove privileges from accounts that do not require them.

Patch Information

MyBB 1.8.40 is the fixed release. See the GitHub Release Tag 1.8.40, the MyBB Version 1.8.40 Details page, and the GitHub Security Advisory GHSA-c2hm-g9w6-pv6x for release notes and advisory content. The corrective commit is c077e6c29755187c4df78a1e674dd61bc55701b3.

Workarounds

If patching cannot be performed immediately, restrict the calendar module through MyBB group permissions to trusted users only.
Temporarily disable calendar moderator permissions across all user groups until 1.8.40 is deployed.
Deploy a web application firewall rule to block unauthenticated or low-trust access to calendar.php actions beyond event viewing.

bash

# Verify installed MyBB version against the fixed release
curl -s https://forum.example.com/ | grep -Eo 'MyBB [0-9]+\.[0-9]+\.[0-9]+'

# On the server, confirm the patched authorization check is present
grep -n "event\['private'\] == 1" /var/www/mybb/calendar.php