Summary
The reply form can reveal subjects and full post text from forums where the requester lacks canviewthreads.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- New Reply thread review and quoting
- Affected function
- newreply.php — permission gate / Thread Review / quote assembly
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-863, CWE-200
Technical Summary
The reply form can reveal subjects and full post text from forums where the requester lacks canviewthreads.
Prerequisites and Permissions
A registered account able to reply. Direct thread review requires canpostreplys in the target forum; cross-forum quoting requires reply permission in a carrier forum and canview on the restricted source.
Affected Locations
newreply.php — permission gate / Thread Review / quote assembly
Reproducible Proof
In an isolated lab, deny canviewthreads on a visible marker forum and confirm showthread.php rejects access. Check the new-reply Thread Review with reply permission. Separately use a permitted carrier thread and a marker source post to check the cross-forum quote path.
Vulnerable Code
if($forumpermissions[&class="tok-comment">#39;canviewclass="tok-string">'] == 0 || $forumpermissions['canpostreplys'] == 0)
{
error_no_permission();
}
class="tok-comment">// Source report: canviewthreads is absent from this reply gate.Severity
medium
CVSS
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Technical Analysis
The initial reply gate checks canview and canpostreplys but omits canviewthreads. Thread Review then renders restricted posts. Separately, cross-forum quote collection calls get_unviewable_forums() without requesting thread-readability restrictions; loading all quotes can prefill a restricted post into a reply form in another forum. The second path requires reply permission in some forum, not necessarily the restricted forum.
Original MyBB finding 31, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Confidentiality: restricted thread subjects and full post bodies. No direct integrity or availability impact established by these disclosure paths.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Require thread-readability for both direct reply context and each quoted post, including cross-forum quotes.
Vendor advisory: https://github.com/advisories/GHSA-58xm-q4mj-33q9
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.