Summary
A moderator of one forum can schedule moderation actions against threads in another forum because authorization uses a request-supplied forum ID instead of each target thread’s real forum.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- Delayed moderation
- Affected function
- moderation.php — do_delayedmoderation / cancel_delayedmoderation; inc/tasks/delayedmoderation.php
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-863, CWE-639
Technical Summary
A moderator of one forum can schedule moderation actions against threads in another forum because authorization uses a request-supplied forum ID instead of each target thread’s real forum.
Prerequisites and Permissions
An authenticated moderator with the relevant moderation permissions in at least one forum; ordinary members are denied.
Affected Locations
moderation.php — do_delayedmoderation / cancel_delayedmoderation; inc/tasks/delayedmoderation.php
Reproducible Proof
In an isolated lab, assign a test moderator to forum A only and create a disposable target thread in forum B. Compare a denied immediate action against the target with a delayed action authorized using forum A and selecting the disposable B thread. Inspect the scheduled record and its effect only on disposable test data.
Vulnerable Code
class="tok-comment">// Source report excerpt, moderation.php.
$fid = $mybb->get_input(&class="tok-comment">#39;fid', MyBB::INPUT_INT);
$tids = getids($fid, &class="tok-comment">#39;forum');
class="tok-comment">// ...
if(!is_moderator($fid, &class="tok-comment">#39;canmanagethreads')) { error_no_permission(); }Severity
high
CVSS
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Technical Analysis
The inline delayed-moderation flow validates is_moderator(fid, ...) using fid from the request. Selected thread IDs originate in an attacker-controlled inline-moderation cookie and are not verified to belong to that forum. The scheduled task subsequently performs the stored actions without rechecking target permissions. Cancellation similarly authorizes a supplied forum while deleting a queued entry by its independent delayed-action ID.
Original MyBB finding 06, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Integrity and availability: a limited moderator can affect threads outside their assigned forums, including deletion and changes to thread state. Publication-related actions can also affect confidentiality.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Authorize each selected thread’s actual forum before storing or executing an action, and authorize cancellation against the queued action’s real scope.
Vendor advisory: https://github.com/advisories/GHSA-76vm-4fx4-jr56
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.