CVE-2026-58054

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.40

Description An issue exists where users with limited Admin Control Panel (ACP) access can assign any usergroup to an account during creation or editing. This occurs because the verify usergroup() function in the user module datahandler unconditionally returns true for the Administrators group (gid 4). Consequently, an administrator with only delegated user-management permissions can assign the Administrators group to an account, leading to a privilege escalation to the full Administrator permission set.

Recommendations Update MyBB to a version newer than 1.8.40. Review and restrict user permissions within the Admin Control Panel to minimize the risk of unauthorized group assignment.