CVE-2026-45121: MyBB Calendar Auth Bypass Vulnerability

CVE-2026-45121 Overview

CVE-2026-45121 is an authorization flaw in MyBB, the free and open source forum software. Versions prior to 1.8.40 fail to consistently enforce permission checks in the calendar module. Authenticated users can obtain titles of calendars they should not be able to view.

The root of the issue is in calendar.php, where calendar-selection paths evaluate permissions against an invalid calendar context before returning calendar titles. This constitutes an incorrect authorization weakness classified under [CWE-863].

The issue is fixed in MyBB version 1.8.40.

Critical Impact
Authenticated forum users can enumerate titles of otherwise inaccessible calendars, leaking metadata about restricted forum sections.

Affected Products

MyBB forum software versions prior to 1.8.40
Deployments using the calendar module with restricted calendar permissions
Self-hosted MyBB instances that have not applied the 1.8.40 patch

Discovery Timeline

2026-08-18 - CVE-2026-45121 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45121

Vulnerability Analysis

The vulnerability resides in the calendar-selection logic of calendar.php. When the code iterates over available calendars to build a selection list, it checks the canviewcalendar permission against the wrong calendar context. Specifically, the check references $calendar['cid'] (an outer or uninitialized variable) instead of $calendar_option['cid'] (the current iterated calendar).

As a result, the permission decision is not tied to the calendar whose title is about to be rendered. Authenticated users receive calendar titles that should be gated behind the canviewcalendar permission. The disclosure is limited to calendar names, but this metadata may reveal internal group structure, private event categories, or administrative content.

Exploitation requires only an authenticated forum account with low privileges. No user interaction is needed, and integrity or availability are not affected.

Root Cause

The root cause is a variable-name mismatch producing an incorrect authorization check [CWE-863]. The loop evaluates permissions using an invalid calendar identifier, causing the guard to succeed under conditions where it should deny access to the calendar title.

Attack Vector

An authenticated attacker sends a standard request to the calendar module. Because the permission check is bound to an invalid context, the server returns titles for calendars the attacker cannot otherwise access. The attack is remote, low complexity, and requires no privileges beyond a registered forum account.

php

// Security patch in calendar.php (MyBB 1.8.40)
// Fix: Insufficient permission check for calendar select
$query = $db->simple_select("calendars", "*", "", array("order_by" => "name", "order_dir" => "asc"));
while($calendar_option = $db->fetch_array($query))
{
-    if($calendar_permissions[$calendar['cid']]['canviewcalendar'] == 1)
+    if($calendar_permissions[$calendar_option['cid']]['canviewcalendar'] == 1)
    {
        $calendar_option['name'] = htmlspecialchars_uni($calendar_option['name']);
        if($calendar_option['cid'] == $mybb->input['calendar'])

Source: GitHub Commit 78e07fe

The patch replaces $calendar['cid'] with $calendar_option['cid'], binding the permission check to the calendar currently being processed by the loop.

Detection Methods for CVE-2026-45121

Indicators of Compromise

Authenticated HTTP GET requests to calendar.php from accounts that have no legitimate access to restricted calendars
Repeated calendar-selection requests enumerating multiple calendar parameter values in short succession
Web server logs showing low-privilege users accessing calendar listings before the 1.8.40 upgrade

Detection Strategies

Review web application logs for anomalous access patterns against calendar.php from non-privileged user IDs
Compare rendered calendar titles in responses against each user's group permissions to detect inconsistencies
Correlate MyBB user activity records with calendar module hits to identify enumeration behavior

Monitoring Recommendations

Enable verbose access logging on the MyBB web tier and forward logs to a centralized analytics platform
Alert on user accounts issuing large volumes of calendar.php requests with varying calendar parameters
Track version fingerprints of MyBB deployments to confirm patched status across managed forums

How to Mitigate CVE-2026-45121

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later using the official MyBB 1.8.40 release
Audit calendar permission assignments to confirm the intended visibility of each calendar
Review recent access logs for signs of calendar enumeration by low-privilege accounts

Patch Information

The fix is available in MyBB 1.8.40. The corrective commit is GitHub Commit 78e07fe, and full details are published in the GitHub Security Advisory GHSA-r25v-7pcm-q34p. Administrators should follow the standard MyBB upgrade procedure and verify the deployed version after patching.

Workarounds

Restrict access to the calendar module at the web server or reverse proxy layer until the patch is applied
Temporarily disable the calendar feature in the MyBB Admin Control Panel for untrusted user groups
Limit forum registrations and require account approval to reduce the pool of authenticated attackers

bash

# Verify MyBB version after upgrade
grep -R "MYBB_VERSION" /path/to/mybb/inc/settings.php

# Example nginx rule to block calendar.php for unauthenticated traffic
location = /calendar.php {
    if ($http_cookie !~* "mybbuser=") { return 403; }
}