Summary
The All Reports view can become board-wide when the moderator’s forum restriction is empty, exposing reported content outside their assignment.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- Moderator All Reports view
- Affected function
- modcp.php — action=allreports
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-863, CWE-200
Technical Summary
The All Reports view can become board-wide when the moderator’s forum restriction is empty, exposing reported content outside their assignment.
Prerequisites and Permissions
A moderator with canmanagereportedcontent whose per-forum reported-post permissions produce an empty restriction.
Affected Locations
modcp.php — action=allreports
Reproducible Proof
In an isolated lab, create a marker report in an out-of-scope forum. Use a limited moderator with the described permission configuration and compare ordinary reports access with action=allreports. Check whether the marker appears.
Vulnerable Code
if($mybb->usergroup[&class="tok-comment">#39;canmanagereportedcontent'] == 0) error_no_permission();
class="tok-comment">// ... source report display-query fragment
class="tok-string">"... WHERE 1=1 {$wflist_reports} ..."
class="tok-comment">// Empty wflist_reports => no forum restriction.Severity
medium
CVSS
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Technical Analysis
The view checks global canmanagereportedcontent. Its forum restriction is constructed only when the moderator holds canmanagereportedposts in at least one forum. Without that fragment, the display query can run without the intended forum WHERE clause. Unlike related reports flows, allreports lacks a guard rejecting a moderator with no authorized reported-post forums.
Original MyBB finding 28, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Confidentiality: reports and referenced content from forums outside the moderator’s scope, with other report types potentially included. No direct modification or service disruption established by this view-only finding.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Reject empty authorization scopes and constrain report visibility to authorized forums and report types.
Vendor advisory: https://github.com/advisories/GHSA-47mm-6v2r-2rr6
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.