Description

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T16:17:07.527Z",
  "pubdate": "2026-08-18T16:17:07.527Z",
  "executiveSummary": "MyBB prior to version 1.8.40 suffers from an improper authorization vulnerability within the Mod CP Report Center, specifically concerning the handling of report status modifications. The vulnerability stems from inconsistent permission validation during the execution of report management actions within the administration control panels.\nThe flaw allows authenticated moderators who lack the explicit canmanagereportedcontent or canmanagereportedposts permissions to bypass access control restrictions and successfully mark reports as resolved. Attackers require a valid moderator account with general Mod CP access (canmodcp) to exploit this authorization gap.\nThe risk implication involves unauthorized modification of moderation states, potentially leading to the concealment of reported content, disruption of moderation workflows, and integrity compromise of the reporting mechanism. Remediation requires upgrading the MyBB installation to version 1.8.40 or later, where consistent permission checks are enforced.",
  "technicalDetails": "The vulnerability resides in the Mod CP Report Center component of MyBB, specifically within the report-management logic handled by modcp.php under the action=do_reports parameter. The root cause is an inconsistent permission check implementation where the Mark Selected as Read handler properly verifies the base canmodcp capability but fails to adequately validate finer-grained privileges such as canmanagereportedcontent or canmanagereportedposts.\nDuring normal execution, permission validation should restrict report manipulation queries based on the scope of forums assigned to the moderator. However, when no specific forums are in scope for the authenticated user, the internal variable $flist_reports remains empty. Due to the lack of strict conditional validation tied to specific report management capabilities, the underlying SQL UPDATE statement targeting the mybb_reportedcontent table executes without the expected permission-based limitation.\nThe attack flow proceeds as follows: First, an authenticated malicious or compromised user with standard moderator privileges (canmodcp) but lacking explicit report management rights navigates to the vulnerable endpoint. Second, the user issues an HTTP request to modcp.php?action=do_reports with parameters configured to mark selected reports as read or resolved. Third, the application processes the request, evaluating only the broader modcp capability while bypassing the missing specific permissions due to the flawed logic handling empty forum scopes. Finally, the database executes the UPDATE mybb_reportedcontent query, altering the state of reported content despite the user's lack of authorization.\nAffected versions include all MyBB deployments prior to 1.8.40. Exploitation requires network access to the forum software and a low-privileged moderator session capable of accessing the Mod CP."
}