Description

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T16:17:07.093Z",
  "pubdate": "2026-08-18T16:17:07.093Z",
  "executiveSummary": "An inconsistent permission validation vulnerability exists within the calendar module of MyBB prior to version 1.8.40. The security flaw allows authenticated users to enumerate and access the titles of calendars that should otherwise be restricted based on access control lists.\nThe vulnerability directly impacts the confidentiality of administrative or private calendar metadata within deployed forum instances. The risk implication centers on unauthorized information disclosure, enabling malicious actors to map out hidden structural elements of the target application.\nExploitation of this vulnerability requires the attacker to possess authenticated user privileges within the MyBB platform. The capability is constrained to retrieving calendar titles through specific application paths without requiring elevated administrative privileges.\nRemediation requires updating the MyBB software to version 1.8.40 or later, where the underlying permission check validation logic within the affected calendar-selection mechanisms has been properly corrected.",
  "technicalDetails": "The root cause of the vulnerability stems from flawed permission validation logic implemented within the calendar module of MyBB. Specifically, the vulnerable component resides in calendar.php, where calendar-selection paths execute authorization checks against an invalid calendar context prior to returning data to the client.\nBecause the permission verification logic evaluates an improper or invalid context, the access control restriction fails to block the retrieval of sensitive metadata. Consequently, the application processes the request and discloses uniquely identifying implementation details, specifically the titles of inaccessible calendars, to unauthorized callers.\nThe attack flow proceeds as follows: First, an authenticated user issues a request to calendar.php targeting specific calendar-selection paths. Second, the application executes a permission evaluation against an invalid calendar context rather than the requested entity, causing the authorization gate to improperly succeed or fail open for title retrieval. Third, the backend queries and returns the titles of calendars for which the user possesses no legitimate viewing permissions. Finally, the authenticated attacker harvests the unauthorized metadata to identify hidden or restricted scheduling contexts.\nThe vulnerability affects MyBB versions prior to 1.8.40. Exploitation requires active authentication on the target forum, meaning anonymous or unauthenticated users cannot trigger the flaw. The privilege requirement is minimal, as standard authenticated users can execute the attack. The attack vector is exposed via standard HTTP requests handled by the PHP application environment running the forum software."
}