MyBB: Reply quoting uses the carrier forum’s moderator permissions

Summary

A moderator can quote hidden posts from another viewable forum because deleted/unapproved visibility is authorized against the reply thread’s forum instead of each quoted post’s forum.

Affected Products

MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.

Affected Scope

Product

MyBB

Component

New Reply quote visibility

Affected function

newreply.php — visible_where construction and cross-forum quote query

Affected versions

MyBB 1.8.40 (tested); consult vendor advisory for full range

CWE

CWE-863, CWE-200

Technical Summary

A moderator can quote hidden posts from another viewable forum because deleted/unapproved visibility is authorized against the reply thread’s forum instead of each quoted post’s forum.

Prerequisites and Permissions

A moderator with canviewdeleted and/or canviewunapprove in a carrier forum, and basic canview access to the target forum.

Affected Locations

newreply.php — visible_where construction and cross-forum quote query

Reproducible Proof

In an isolated lab, grant a test moderator hidden-post visibility in forum A only. Create a harmless hidden marker post in viewable forum B. Load its quote through a reply in A and compare with the moderator’s denied direct hidden-post access in B.

Vulnerable Code

class="tok-comment">// Source report: $fid is the carrier forum, not each quoted post's forum.
if(is_moderator($fid, &class="tok-comment">#39;canviewunapproveclass="tok-string">') && is_moderator($fid, 'canviewdeleted'))
    $visible_where = &class="tok-comment">#39;AND p.visible IN (-1,0,1)';
class="tok-comment">// ... clause subsequently reused for a cross-forum quote query.

Severity

medium

CVSS

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Technical Analysis

newreply.php derives permitted post visibility states from canviewdeleted/canviewunapprove on the carrier thread’s fid. With cross-forum quote loading, that same visible_where condition is applied to posts selected from other forums. A moderator grant in the carrier forum is therefore reused for hidden posts outside that grant. The target forum must still be viewable; this is distinct from the missing canviewthreads check in finding 31.

Original MyBB finding 33, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.

Impact

Confidentiality: full bodies of soft-deleted or unapproved posts outside the moderator’s assigned forums. No direct integrity or availability impact established.

Remediation

Upgrade to MyBB 1.8.41 or a later supported release. Evaluate visibility privileges against each quoted post’s actual forum before including its body.

Vendor advisory: https://github.com/advisories/GHSA-232v-mm3q-9wpj

Timeline

• 2026-11-06Published
• 2026-11-06Advisory published

References

• GHSA-232v-mm3q-9wpj

Credits

Reported by Aria Akhavan, Haikhavan.