MyBB: Multiquote exposes draft, deleted and other users’ restricted posts

Summary

The multiquote endpoint can return draft and soft-deleted post content, and posts belonging to other users in own-thread-only forums, because its visibility checks do not consistently reject unauthorized rows.

Affected Products

MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.

Affected Scope

Product

MyBB

Component

Multiquote AJAX endpoint

Affected function

xmlhttp.php — action=get_multiquoted; multiquote cookie

Affected versions

MyBB 1.8.40 (tested); consult vendor advisory for full range

CWE

CWE-639, CWE-284, CWE-200

Technical Summary

The multiquote endpoint can return draft and soft-deleted post content, and posts belonging to other users in own-thread-only forums, because its visibility checks do not consistently reject unauthorized rows.

Prerequisites and Permissions

A forum the requester can view. Draft/deleted visibility and own-thread-only restrictions apply to the selected target. The own-thread-only case requires an appropriate registered account.

Affected Locations

xmlhttp.php — action=get_multiquoted; multiquote cookie

Reproducible Proof

In an isolated 1.8.40 lab, create a draft with a unique harmless marker in a guest-viewable forum. Place its post ID in the multiquote cookie and request xmlhttp.php?action=get_multiquoted. Compare the returned marker with normal thread access. Separately use two test users in an own-thread-only forum and confirm that quoting the other user’s approved post discloses its marker.

Vulnerable Code

class="tok-comment">// Source report: the inner rejection only handles unapproved posts.
if($quoted_post[&class="tok-comment">#39;visibleclass="tok-string">'] == 0 && !($mybb->settings['showownunapprovedclass="tok-string">'] && $quoted_post['uidclass="tok-string">'] == $mybb->user['uid']))
{
    continue;
}
class="tok-comment">// Other unauthorized states can reach parse_quoted_message().

Severity

high

CVSS

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Technical Analysis

The endpoint loads post IDs from the requester-controlled multiquote cookie. Its outer condition detects several visibility and ownership restrictions, but the inner continue applies only to unapproved posts (visible = 0). Drafts (visible = -2), soft-deleted posts (visible = -1), and approved posts in canonlyviewownthreads forums can fall through to parse_quoted_message(). The query still excludes fully unviewable forums: this is not an unrestricted bypass of every forum permission. The vendor grouped original findings 04 and 11 under one advisory.

Original MyBB finding 04 and 11, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.

Impact

Confidentiality: full post text and associated quote metadata can be disclosed. Guests can target draft content in otherwise viewable forums; registered users can bypass own-thread-only isolation. No direct integrity or availability impact established.

Remediation

Upgrade to MyBB 1.8.41 or a later supported release. Apply visibility and ownership checks independently for each quoted post. Reject unauthorized draft, deleted, unapproved and own-thread-only content.

Vendor advisory: https://github.com/advisories/GHSA-fwfx-94pg-6f96

Timeline

• 2026-11-06Published
• 2026-11-06Advisory published

References

• GHSA-fwfx-94pg-6f96

Credits

Reported by Aria Akhavan, Haikhavan.