CVE-2026-45124: MyBB: Mod CP report resolution missing authorization
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=doreports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flistreports is empty and the UPDATE mybbreportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which MyBB versions are affected?
MyBB installations prior to 1.8.40 are affected. The issue is fixed in MyBB 1.8.40.
What access is required to exploit this issue?
An attacker needs a moderator-level account that can access the Mod CP through canmodcp. They do not need the canmanagereportedcontent or canmanagereportedposts permissions when no forums are in scope.
What is the practical impact of successful exploitation?
The vulnerable handler can mark selected reports as read or resolved without the expected permission-based restriction when the moderator has no forums in scope and $flist_reports is empty. This can affect report-resolution integrity, but the provided data does not indicate confidentiality or availability impact.
What should administrators do if they cannot patch immediately?
Upgrade to MyBB 1.8.40. If an immediate upgrade is not possible, restrict Mod CP access so accounts lacking report-management permissions cannot reach the affected functionality.