CVE-2026-45122: MyBB Calendar Auth Bypass Vulnerability

CVE-2026-45122 Overview

CVE-2026-45122 is a broken access control vulnerability [CWE-863] in MyBB, an open source forum software. Versions prior to 1.8.40 fail to validate moderation permissions on the destination calendar when moving events. A user with moderation rights on a source calendar can move an event to a target calendar where they hold only viewing permission. The do_move action in calendar.php does not check canmoderateevents on the target calendar before completing the move. MyBB fixed the issue in version 1.8.40.

Critical Impact
Authenticated forum moderators can bypass calendar authorization boundaries and place events into calendars they cannot legitimately moderate, compromising integrity of moderated calendar content.

Affected Products

MyBB forum software versions prior to 1.8.40
MyBB calendar module (calendar.php)
Self-hosted MyBB deployments exposing calendar functionality

Discovery Timeline

2026-08-18 - CVE-2026-45122 published to NVD
2026-08-18 - Last updated in NVD database
MyBB 1.8.40 - Vendor releases patched version addressing the flaw

Technical Details for CVE-2026-45122

Vulnerability Analysis

The flaw resides in the calendar event move workflow of MyBB. When a moderator initiates a move, the application checks whether the requester holds canmoderateevents on the source calendar but omits the same check on the destination calendar. An attacker who is already a moderator of at least one calendar can therefore transplant events into any other calendar accessible for viewing, including calendars maintained by other moderator groups. The vulnerability is a classic authorization gap [CWE-863] where server-side enforcement trails the underlying permission model. Because the move succeeds through legitimate application logic, standard input filtering and web application firewalls do not intercept the request. The issue affects integrity of calendar content but does not expose confidential data or crash the service.

Root Cause

The do_move action in calendar.php calls error_no_permission() when the source calendar lacks canmoderateevents, but does not repeat the check against $calendar_permissions[$new_calendar['cid']]['canmoderateevents']. The permission model assumed source authorization was sufficient, ignoring that the destination represents a separate trust boundary.

Attack Vector

Exploitation requires an authenticated user with moderator privileges on any single calendar. The attacker crafts a normal move request pointing to a new_calendar identifier they can view but not moderate. The server processes the update, writes the new cid, and completes the move without further authorization.

php

 		error_no_permission();
 	}
 
+	if($calendar_permissions[$new_calendar['cid']]['canmoderateevents'] != 1)
+	{
+		error_no_permission();
+	}
+
 	$updated_event = array(
 		"cid" => $new_calendar['cid']
 	);

Source: MyBB commit 86ed2058. The patch introduces the missing canmoderateevents check on the destination calendar before the event record is updated.

Detection Methods for CVE-2026-45122

Indicators of Compromise

Calendar events whose cid value changed to a calendar the acting user does not moderate
Moderator log entries showing event moves originating from users without destination-calendar moderation rights
Unexpected event appearances in calendars maintained by other moderator teams

Detection Strategies

Audit the MyBB mybb_events table and moderator logs for do_move actions and cross-reference the actor's calendar permissions at the time of the action
Enable verbose logging on calendar.php requests carrying the action=do_move parameter and inspect new_calendar identifiers against the actor's canmoderateevents grants
Deploy web server access-log queries that flag POSTs to calendar.php with do_move from users who moderate few or no calendars

Monitoring Recommendations

Track the MyBB version string exposed by administrative pages and alert on any instance below 1.8.40
Subscribe to the GitHub Security Advisory GHSA-839m-gpw8-59j4 for follow-up updates
Review moderator account rosters and flag accounts that hold moderation over a single calendar but generate high volumes of event move activity

How to Mitigate CVE-2026-45122

Immediate Actions Required

Upgrade all MyBB installations to version 1.8.40 or later using the MyBB 1.8.40 release notes
Review recent calendar move history and revert any events that were relocated by users lacking destination moderation rights
Temporarily restrict moderator group memberships on high-value calendars until the upgrade is verified

Patch Information

The fix is delivered in MyBB 1.8.40 via commit 86ed2058. The patched calendar.php now invokes error_no_permission() when the destination calendar's canmoderateevents flag is not set for the acting user. Administrators should apply the official release tarball from the MyBB 1.8.40 tag rather than backporting the diff manually where possible.

Workarounds

Disable the calendar module in the MyBB Admin Control Panel until the upgrade is applied
Reduce canmoderateevents grants so that only trusted administrators can execute move operations
Apply the upstream commit as a hotfix on installations that cannot immediately move to 1.8.40

bash

# Verify installed MyBB version and confirm patched release
grep -R "'version_code'" ./inc/version.php
# Expected output for the patched build:
#   $version_code = 1840;