Summary
An unauthenticated visitor can download attachments belonging to another user’s draft post. MyBB 1.8.40 skips the normal permission checks for draft posts without checking ownership. The vendor confirmed the issue and fixed it in MyBB 1.8.41 (GHSA-gr56-j98m-p582).
Affected Products
MyBB 1.8.40. The original report also identifies earlier 1.8.x releases; use the linked vendor advisory for the authoritative affected range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- Attachment download handler
- Affected function
- attachment.php
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-639, CWE-284
Technical Summary
Draft attachment downloads bypass ownership and forum authorization because attachment.php skips its permission block for posts.visible = -2.
Prerequisites and Permissions
No authentication required. A victim draft must have an attachment of a type available to guests.
Affected Locations
attachment.php: draft permission branch; aid parameter; posts.visible = -2.
Reproducible Proof
On an isolated MyBB 1.8.40 installation, create a draft with a harmless marker attachment as user A. As an anonymous visitor, request attachment.php?aid=<that attachment ID>. The vulnerable release returns the marker file without authenticating its owner. Compare with a protected published attachment as a control.
Vulnerable Code
class="tok-comment">// Source report excerpt, attachment.php; normal checks are inside this branch.
if($post[&class="tok-comment">#39;visible'] != -2)
{
class="tok-comment">// forum/thread/attachment permission checks
}Severity
high
CVSS
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Technical Analysis
In attachment.php, the normal forum, thread and attachment authorization checks are enclosed in a branch that runs only when posts.visible != -2. For a draft post (visible = -2), the handler does not verify that the requester owns the post before streaming its attachment. File-type group permissions do not enforce draft ownership. An anonymous requester who supplies a draft attachment ID can therefore retrieve unpublished files, including files associated with restricted forums.
Original report: finding 01, submitted 9 August 2026. The vendor announced MyBB 1.8.41 on 16 September and explicitly mapped finding 01 to GHSA-gr56-j98m-p582 on 17 September 2026.
Impact
Confidentiality: disclosure of unpublished draft attachments belonging to other users. Integrity and availability: no direct compromise established by this finding.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Enforce ownership and applicable forum/thread/attachment permissions for draft attachment downloads. Vendor advisory: https://github.com/advisories/GHSA-gr56-j98m-p582
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.