CVE-2026-45121

Published: Aug 18, 2026Modified: Aug 18, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://github.com/mybb/mybb/commit/78e07fea34a6f6c326e668526bfb8e451c19e966

Source: security-advisories@github.com

https://github.com/mybb/mybb/releases/tag/mybb_1840

Source: security-advisories@github.com

https://github.com/mybb/mybb/security/advisories/GHSA-r25v-7pcm-q34p

Source: security-advisories@github.com

https://mybb.com/versions/1.8.40

Source: security-advisories@github.com

Timeline

No history available yet.