CVE-2026-45122: MyBB: Insufficient permission check for calendar event move
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the domove action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBB calendar moduleto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which deployments are affected?
Instances running MyBB versions earlier than 1.8.40 are affected if they use calendars with differing event-moderation permissions. The issue is fixed in MyBB 1.8.40.
What access does an attacker need?
An attacker needs moderation permission on the calendar that currently contains the event. They can then move that event into a destination calendar where they have viewing permission but do not have event-moderation permission.
What should administrators do if they cannot patch immediately?
Upgrade MyBB to version 1.8.40. Until upgrading, restrict event-moderation privileges on source calendars and review moves into calendars where moderators do not also have event-moderation rights.