Summary
A moderator can relocate posts into a forum they are not authorized to moderate because split and move-posts handlers validate only the source forum.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- Post split and move moderation
- Affected function
- moderation.php — do_split / do_multisplitposts / do_multimoveposts; inc/class_moderation.php — split_posts
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-281, CWE-639, CWE-284
Technical Summary
A moderator can relocate posts into a forum they are not authorized to moderate because split and move-posts handlers validate only the source forum.
Prerequisites and Permissions
A moderator with canmanagethreads in the source forum. The attacker need not moderate the chosen destination.
Affected Locations
moderation.php — do_split / do_multisplitposts / do_multimoveposts; inc/class_moderation.php — split_posts
Reproducible Proof
In an isolated lab, grant a test moderator rights in forum A but not B. Use disposable marker posts in A and test split/move-posts to B. Compare with a normal thread move that enforces destination permission. Confirm resulting forum IDs using test data only.
Vulnerable Code
$moveto = $mybb->get_input(&class="tok-comment">#39;moveto', MyBB::INPUT_INT);
$newforum = get_forum($moveto);
class="tok-comment">// ... destination permission check absent in the source report
$newtid = $moderation->split_posts($pids, $tid, $moveto, $mybb->get_input(&class="tok-comment">#39;newsubject'));Severity
high
CVSS
8.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Technical Analysis
The affected handlers accept a destination forum but omit the destination checks used by the thread move/merge flows. After authorizing the source posts, they write content to the supplied destination without enforcing destination visibility or the canmovetononmodforum permission. This can move protected source content into a public forum or inject posts into a forum outside the moderator’s assignment.
Original MyBB finding 21, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Confidentiality: moving protected content to a publicly readable destination exposes it. Integrity: posts can be inserted or relocated across unauthorized forum boundaries. Availability may be affected by moving content away from its intended location.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. Enforce destination visibility and moderator/move permissions consistently before relocating posts.
Vendor advisory: https://github.com/advisories/GHSA-9c3r-g4fj-2gp4
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.