Description

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T16:17:06.937Z",
  "pubdate": "2026-08-18T16:17:06.937Z",
  "executiveSummary": "A consistency flaw in access control mechanisms within the calendar module of MyBB prior to version 1.8.40 introduces an authorization bypass vulnerability.\nThe vulnerability allows users possessing standard viewing and moderation permissions to improperly access and moderate private events due to missing access validation checks.\nThe affected product is MyBB forum software prior to version 1.8.40, specifically impacting the calendar module and associated functions.\nThe risk implications involve unauthorized exposure of confidential event data and unauthorized administrative manipulation of private calendar entries across the forum system.\nAttacker capabilities are constrained to authenticated users with existing viewing and moderation permissions, leveraging the capability to interact with the calendar module.\nExploitation requirements rely on interacting with specific actions within calendar.php where private-event validation checks are omitted.\nThe issue represents a failure in consistent privilege enforcement across application routing endpoints, violating the intended limited-access behavior defined in language localization files.",
  "technicalDetails": "The root cause of the vulnerability stems from inconsistent enforcement of private-event status validation within the calendar module of MyBB.\nWhile the function get_events() located in inc/functions_calendar.php and specific event actions properly implement private-event checks, these critical security validations are missing from the remaining action handlers within calendar.php.\nThe vulnerable component is the calendar module logic, specifically handling event interactions and routing inside calendar.php and inc/functions_calendar.php.\nAffected versions comprise all MyBB deployments prior to version 1.8.40.\nAuthentication requirements dictate that the attacker must possess an authenticated session with standard viewing and moderation privileges on the target MyBB forum.\nPrivilege requirements do not necessitate administrator status; standard users with viewing and moderation capabilities can trigger the authorization bypass.\nNetwork exposure is inherent to the web-based nature of the MyBB forum application, accessible via standard HTTP/HTTPS protocols where the calendar module is enabled.\nThe attack flow proceeds as follows: an authenticated user navigates to calendar.php actions that lack the requisite private-event validation checks. Because the underlying controller or function fails to verify whether an event is marked as private against the user's explicit authorization level, the application processes the request. The user is consequently granted unauthorized visibility into private event data or permitted to execute moderation actions against events intended to be restricted, bypassing the intended security policy enforced elsewhere in the module.\nPost-exploitation impact includes the unauthorized disclosure of sensitive schedule information, metadata leakage from private community events, and unauthorized modification or deletion of restricted calendar entries by users lacking the administrative authorization to do so."
}