Summary
A delegated administrator with user-management permission can store a View Manager title that is rendered without HTML encoding to other administrators.
Affected Products
MyBB 1.8.40 (tested in the original report). The original report also identifies earlier 1.8.x releases; consult the vendor advisory for the authoritative range. Fixed in 1.8.41.
Affected Scope
- Product
- MyBB
- Component
- ACP Users View Manager
- Affected function
- admin/inc/functions_view_manager.php — view title storage/rendering; admin/modules/user/users.php
- Affected versions
- MyBB 1.8.40 (tested); consult vendor advisory for full range
- CWE
- CWE-79, CWE-269
Technical Summary
A delegated administrator with user-management permission can store a View Manager title that is rendered without HTML encoding to other administrators.
Prerequisites and Permissions
A non-super administrator with Can manage users permission. Another administrator must render the malicious public view title.
Affected Locations
admin/inc/functions_view_manager.php — view title storage/rendering; admin/modules/user/users.php
Reproducible Proof
In an isolated lab, create a public View Manager entry with a harmless HTML marker or benign script indicator using a delegated admin. Open the Users View Manager with a separate test administrator and inspect whether the title is encoded. Avoid account changes or server-side execution.
Vulnerable Code
class="tok-comment">// Source report identifies admin/inc/functions_view_manager.php:597.
class="tok-comment">// The view title is interpolated directly in the cell HTML:
{$view[&class="tok-comment">#39;title']}
class="tok-comment">// No HTML encoding is applied at that render sink.Severity
high
CVSS
8.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Technical Analysis
View titles are stored with SQL escaping but are emitted as raw HTML in the View Manager listing. New public views are visible to other administrators. The feature is reachable with user/users permission, so an administrator with limited delegated privileges can place script content into a more privileged administrator’s ACP session. The established defect is stored XSS; downstream administrative actions depend on the victim’s rights and the application’s remaining protections.
Original MyBB finding 40, submitted 9 August 2026. Vendor announced release 1.8.41 on 16 September and supplied the covered-finding/advisory mapping on 17 September 2026.
Impact
Confidentiality and integrity: script execution in another administrator’s authenticated ACP origin can expose accessible data and perform actions with that session’s permissions. Do not treat arbitrary server-side code execution as independently established by this advisory.
Remediation
Upgrade to MyBB 1.8.41 or a later supported release. HTML-encode view titles at every HTML output sink and apply context-appropriate encoding to stored administrator-authored values.
Vendor advisory: https://github.com/advisories/GHSA-22wp-jxm2-5w7m
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.