MyBB: Moderation queue actions can lose forum restrictions

Summary

Moderation queue actions can approve or delete content outside a moderator’s forum scope when a permission-derived SQL restriction is empty.

Affected Products

MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.

Affected Scope

Product

MyBB

Component

Moderation queue actions

Affected function

modcp.php — do_modqueue

Affected versions

MyBB 1.8.40 (tested); consult vendor advisory for full range

CWE

CWE-862, CWE-863

Technical Summary

Moderation queue actions can approve or delete content outside a moderator’s forum scope when a permission-derived SQL restriction is empty.

Prerequisites and Permissions

A moderator with global canmanagemodqueue permission and a per-type permission configuration that produces an empty forum restriction.

Affected Locations

modcp.php — do_modqueue

Reproducible Proof

In an isolated lab, use disposable pending content in a forum outside a limited moderator’s scope. Configure the per-type approval permissions to reproduce the empty-scope condition. Compare denied queue viewing with a submitted action targeting only the disposable IDs, then inspect the resulting approval state.

Vulnerable Code

if($mybb->usergroup[&class="tok-comment">#39;canmanagemodqueue'] == 0) error_no_permission();
class="tok-comment">// ...
$query = $db->simple_select(&class="tok-comment">#39;threadsclass="tok-string">', 'tidclass="tok-string">', 'tid IN (class="tok-string">'.implode(',', $threads).class="tok-string">"){$flist_queue_threads}");
class="tok-comment">// An empty forum fragment removes the per-forum restriction.

Severity

high

CVSS

8.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Technical Analysis

The action handler checks the global canmanagemodqueue permission. Its forum SQL restrictions are built only when the moderator has a matching per-type approval permission in at least one forum. When the restriction is empty, the query can become board-wide. The action flow lacks the explicit no-authorized-forums guard used by the queue view.

Original MyBB finding 27, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.

Impact

Integrity and availability: unauthorized approval or deletion of threads, posts and attachments. Confidentiality can also be affected when approval publishes protected or unapproved content.

Remediation

Upgrade to MyBB 1.8.41 or a later supported release. Fail closed when no authorized forum exists, and scope every affected object to an explicitly authorized forum and content type.

Vendor advisory: https://github.com/advisories/GHSA-7w8v-m728-h542

Timeline

• 2026-11-06Published
• 2026-11-06Advisory published

References

• GHSA-7w8v-m728-h542

Credits

Reported by Aria Akhavan, Haikhavan.