MyBB: Search exposes content from thread-restricted forums

Summary

Search results can disclose subjects and post snippets from forums where canviewthreads denies normal thread access.

Affected Products

MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.

Affected Scope

Product

MyBB

Component

Search and find-user-posts

Affected function

inc/functions_search.php — get_unsearchable_forums; search.php — finduser / finduserthreads / results

Affected versions

MyBB 1.8.40 (tested); consult vendor advisory for full range

CWE

CWE-200, CWE-284

Technical Summary

Search results can disclose subjects and post snippets from forums where canviewthreads denies normal thread access.

Prerequisites and Permissions

A user permitted to search, with canview=1 and canviewthreads=0 on a target forum otherwise eligible for searching.

Affected Locations

inc/functions_search.php — get_unsearchable_forums; search.php — finduser / finduserthreads / results

Reproducible Proof

In an isolated lab, create a unique marker post in a visible forum where the test user lacks canviewthreads. Verify normal thread access is denied, then search for the marker and inspect find-posts-by-user results for leaked subjects/snippets.

Vulnerable Code

if($perms[&class="tok-comment">#39;canviewclass="tok-string">'] != 1 || $perms['cansearchclass="tok-string">'] != 1 || !forum_password_validated($forum, true) || $forum['active'] == 0)
{
    class="tok-comment">// add fid to unsearchable list; canviewthreads is absent
}

Severity

medium

CVSS

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Technical Analysis

Search exclusion logic accounts for canview, cansearch, forum passwords and active state, but does not consistently exclude canviewthreads=0 forums. Search and find-posts/find-threads-by-user paths can therefore surface thread subjects, snippets and identifiers that showthread.php correctly denies.

Original MyBB finding 24, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.

Impact

Confidentiality: thread subjects and post-body snippets in thread-restricted forums. No direct modification or service disruption established.

Remediation

Upgrade to MyBB 1.8.41 or a later supported release. Include thread-readability restrictions in every search and user-post enumeration query.

Vendor advisory: https://github.com/advisories/GHSA-rxgj-m9jm-mxxw

Timeline

• 2026-11-06Published
• 2026-11-06Advisory published

References

• GHSA-rxgj-m9jm-mxxw

Credits

Reported by Aria Akhavan, Haikhavan.