HAIKHAVANSECURITY
🇬🇧EN▾
Early Access →
DEENES
Early Access →
← All advisories
medium

MyBB: Who’s Online reveals restricted thread subjects

Advisory ID
HKV-ADV-2026-034
Tracking ID
HKV-2026-034
Vendor
MyBB
GHSA
GHSA-p768-x2c9-7j8r
Published

Summary

Who’s Online reveals thread subjects and links from forums where the viewer can see the forum but is denied permission to view its threads.

Affected Products

MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.

Affected Scope

Product
MyBB
Component
Who’s Online location rendering
Affected function
inc/functions_online.php; online.php
Affected versions
MyBB 1.8.40 (tested); consult vendor advisory for full range
CWE
CWE-200, CWE-284

Technical Summary

Who’s Online reveals thread subjects and links from forums where the viewer can see the forum but is denied permission to view its threads.

Prerequisites and Permissions

Permission to view Who’s Online and a target forum that is visible but denies canviewthreads. Another session must have a corresponding thread location.

Affected Locations

inc/functions_online.php; online.php

Reproducible Proof

In an isolated lab, deny a test user canviewthreads in a visible forum. Have an authorized account view a marker-titled thread there. Confirm direct access is denied to the test user, then inspect its Who’s Online view for that title.

Vulnerable Code

phpsource excerpt
$unviewableforums = get_unviewable_forums(); class="tok-comment">// source report: missing true argument

Severity

medium

CVSS

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Technical Analysis

The location builder excludes fully unviewable forums but omits canviewthreads. A configuration with canview=1 and canviewthreads=0 is therefore handled differently from normal thread access. When another user views a restricted thread, the online-location output can expose its title and thread identifier.

Original MyBB finding 23, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.

Impact

Confidentiality: restricted thread subjects and identifiers are disclosed. This finding does not establish disclosure of full post bodies or a direct integrity/availability impact.

Remediation

Upgrade to MyBB 1.8.41 or a later supported release. Apply thread-readability permissions when resolving online locations, including canviewthreads.

Vendor advisory: https://github.com/advisories/GHSA-p768-x2c9-7j8r

Timeline

References

Credits

Reported by Aria Akhavan, Haikhavan.