CVE-2026-45124: MyBB Auth Bypass Vulnerability

CVE-2026-45124 Overview

CVE-2026-45124 is a missing authorization vulnerability [CWE-862] in MyBB, the open-source forum software, affecting versions prior to 1.8.40. The flaw resides in the Moderator Control Panel (Mod CP) Report Center, where the modcp.php?action=do_reports handler fails to enforce permission checks consistently. Moderators holding only the canmodcp permission can invoke the Mark Selected as Read action without canmanagereportedcontent or canmanagereportedposts. When no forums are within scope, the $flist_reports variable is empty, and the UPDATE mybb_reportedcontent query runs without the intended permission-based filter. The issue is fixed in MyBB 1.8.40.

Critical Impact
Low-privileged moderators can mark reported content as resolved without holding the required report-management permissions, undermining forum moderation integrity.

Affected Products

MyBB versions prior to 1.8.40
MyBB Moderator Control Panel (modcp.php)
MyBB Report Center (mybb_reportedcontent table)

Discovery Timeline

2026-08-18 - CVE-2026-45124 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-45124

Vulnerability Analysis

The vulnerability is a broken access control issue in the MyBB Mod CP report handling logic. The do_reports action in modcp.php processes the Mark Selected as Read operation for reported content. The handler validates only that the requester holds the general canmodcp capability, without verifying the more specific canmanagereportedcontent or canmanagereportedposts permissions required for report management.

When a moderator with limited scope invokes the action, the internal $flist_reports list of in-scope forums evaluates to empty. Rather than aborting the operation, the code proceeds to execute an UPDATE mybb_reportedcontent query without the intended forum-scoped WHERE clause. This allows any user with basic Mod CP access to close out reports across the entire forum.

Root Cause

The root cause is inconsistent permission enforcement in modcp.php. The do_reports action assumed that upstream permission checks would prevent unprivileged callers from reaching it, but the handler was directly reachable with only the canmodcp capability. Additionally, the empty $flist_reports case was not treated as a permission failure and did not short-circuit the database update.

Attack Vector

An authenticated moderator with baseline Mod CP access submits a POST request to modcp.php?action=do_reports with the Mark Selected as Read form parameters. Because the handler skips the required permission validation, the resulting SQL update marks reports as resolved regardless of the moderator's forum scope or report-management privileges. Exploitation requires low privileges and no user interaction.

php

 $mybb->input['action'] = $mybb->get_input('action');
 if($mybb->input['action'] == "do_reports")
 {
+	if($mybb->usergroup['canmanagereportedcontent'] == 0)
+	{
+		error_no_permission();
+	}
+
+	if($numreportedposts == 0 && $mybb->usergroup['issupermod'] != 1)
+	{
+		error($lang->you_cannot_view_reported_posts);
+	}
+
 	// Verify incoming POST request
 	verify_post_check($mybb->get_input('my_post_key'));

Source: GitHub Commit 5cda5f6. The patch adds an explicit canmanagereportedcontent check and a super-moderator gate before the request verification, ensuring unauthorized callers receive error_no_permission().

Detection Methods for CVE-2026-45124

Indicators of Compromise

Unexpected reportstatus transitions to resolved in the mybb_reportedcontent table performed by moderators lacking the canmanagereportedcontent permission.
Web server access log entries showing POST requests to modcp.php?action=do_reports originating from user accounts with only canmodcp privileges.
Bulk resolution of reports occurring without corresponding entries in the moderator log.

Detection Strategies

Correlate MyBB moderator group permissions with recent updates to mybb_reportedcontent to identify state changes performed by users without report-management rights.
Inspect HTTP request bodies for action=do_reports submissions and validate them against the acting user's effective permissions.
Review MyBB moderator activity logs for reports moved to a resolved state without a matching forum-scope justification.

Monitoring Recommendations

Enable verbose logging on modcp.php and forward access logs to a centralized log platform for correlation with MyBB group membership data.
Alert on database UPDATE statements against mybb_reportedcontent that lack a narrow fid predicate.
Track the ratio of resolved reports per moderator and flag statistical outliers for review.

How to Mitigate CVE-2026-45124

Immediate Actions Required

Upgrade all MyBB installations to version 1.8.40 or later, which contains the authorization fix.
Audit moderator group permissions and remove canmodcp from any group that should not perform report management functions.
Review the mybb_reportedcontent table for reports resolved between the deployment of a vulnerable release and the upgrade, and restore state where appropriate.

Patch Information

The fix is available in MyBB 1.8.40 and documented in GitHub Security Advisory GHSA-gfxj-g7w6-6w4v. The corrective code change is published in GitHub Commit 5cda5f6 and the release notes are at GitHub Release mybb_1840.

Workarounds

Temporarily revoke the canmodcp permission from moderator groups that do not also hold canmanagereportedcontent, if patching cannot be performed immediately.
Restrict access to modcp.php at the web server layer to trusted IP ranges or authenticated administrator sessions until the upgrade completes.

bash

# Verify MyBB version after upgrade
grep -R "MYBB_VERSION" /path/to/mybb/inc/init.php

# Backup the reported content table before remediation
mysqldump -u <user> -p <database> mybb_reportedcontent > mybb_reportedcontent_backup.sql