Description

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T16:17:07.243Z",
  "pubdate": "2026-08-18T16:17:07.243Z",
  "executiveSummary": "A permission validation vulnerability exists within the calendar module of MyBB prior to version 1.8.40. The flaw stems from insufficient authorization checks during the event relocation process, specifically when handling the do_move action within calendar.php. Consequently, a user possessing moderation privileges exclusively on a source calendar can successfully relocate calendar events to an arbitrary destination calendar where they hold only standard viewing permissions. This breaks the intended access control boundary of the forum software, allowing unauthorized users to manipulate event placements in restricted calendars. The risk implication involves unauthorized modification and administrative manipulation of restricted calendar contents by malicious or low-privileged actors who have base forum access and source moderation capabilities. Exploitation requires the attacker to authenticate to the forum, hold moderation privileges on at least one source calendar, and interact with the vulnerable calendar.php endpoint to trigger the unauthorized state transition.",
  "technicalDetails": "The vulnerability resides in the calendar module of MyBB, specifically within the event relocation functionality handled by the do_move action in calendar.php. The root cause of the issue is a logical authorization flaw: the application fails to validate whether the executing user possesses the requisite canmoderateevents permissions for the target destination calendar during an event move operation. While the software appropriately verifies moderation rights against the source calendar, it omits the secondary validation check for the destination context.\nThe attack flow proceeds as follows. First, an authenticated attacker identifies a source calendar where they are provisioned with sufficient moderation privileges (canmoderateevents). Second, the attacker selects a target destination calendar within the application where their security profile restricts them solely to viewing permissions (canview), lacking any administrative or moderation capabilities. Third, the attacker initiates a request targeting calendar.php with the do_move action parameter, specifying the event ID, the source calendar ID, and the restricted destination calendar ID. Fourth, because calendar.php processes the request and executes the database update without validating the attacker's canmoderateevents privileges against the destination calendar identifier, the event is successfully relocated.\nThe vulnerable component is the event relocation logic inside calendar.php across MyBB versions prior to 1.8.40. The vulnerability requires network exposure via the standard web interface, active authentication, and low-privilege moderation access on a source calendar. The payload behavior involves submitting manipulated form data or direct HTTP requests to bypass intended application-layer authorization constraints. The post-exploitation impact includes unauthorized event migration, content pollution of restricted calendars, potential disruption of community schedules, and circumvention of administrative partitioning designed to keep sensitive or private calendar spaces segregated from lower-privileged moderators."
}