CVE-2026-45124 - MyBB: Mod CP report resolution missing authorization

Back Back to CVE browser

MEDIUM

MyBB: Mod CP report resolution missing authorization

Published Aug 18, 2026

4.3

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.

Affected products

Vendor Mybb Product Mybb Default
n/a
- Version
  < 1.8.40
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mybb

n/a

Version	Status	Constraints
< 1.8.40	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61018
Advisory
https://github.com/mybb/mybb/commit/5cda5f6d183bc2cac24f0533e8d3060a9a46cc42
x_refsource_MISC
https://github.com/mybb/mybb/releases/tag/mybb_1840
x_refsource_MISC
https://github.com/mybb/mybb/security/advisories/GHSA-gfxj-g7w6-6w4v
x_refsource_CONFIRM
https://mybb.com/versions/1.8.40
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61018		Advisory
https://github.com/mybb/mybb/commit/5cda5f6d183bc2cac24f0533e8d3060a9a46cc42		x_refsource_MISC
https://github.com/mybb/mybb/releases/tag/mybb_1840		x_refsource_MISC
https://github.com/mybb/mybb/security/advisories/GHSA-gfxj-g7w6-6w4v		x_refsource_CONFIRM
https://mybb.com/versions/1.8.40		x_refsource_MISC