PT-2026-77174 · Mybb · Mybb
CVE-2026-45120
·
Published
2026-08-18
·
Updated
2026-08-18
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
MyBB versions prior to 1.8.40
Description
The calendar module fails to consistently verify the status of private events. This allows users who possess viewing and moderation permissions to access and moderate events marked as private. The issue occurs because the private-event check implemented in the
get events() function within inc/functions calendar.php and the event action is absent from other actions in calendar.php.Recommendations
Update to version 1.8.40.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mybb