CVE-2026-45122

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mybb/mybb/commit/86ed2058e7f9a2c14828e731f684e997f9bb220c
https://github.com/mybb/mybb/releases/tag/mybb_1840
https://github.com/mybb/mybb/security/advisories/GHSA-839m-gpw8-59j4
https://mybb.com/versions/1.8.40

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-18 16:17

Updated : 2026-09-08 21:02

NVD link : CVE-2026-45122

Mitre link : CVE-2026-45122

CVE.ORG link : CVE-2026-45122

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-45122", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45122", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T17:52:37.864441Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mybb", "product": "mybb", "versions": [{"status": "affected", "version": "< 1.8.40"}]}]}], "published": "2026-08-18T16:17:07.243", "references": [{"url": "https://github.com/mybb/mybb/commit/86ed2058e7f9a2c14828e731f684e997f9bb220c", "source": "security-advisories@github.com"}, {"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840", "source": "security-advisories@github.com"}, {"url": "https://github.com/mybb/mybb/security/advisories/GHSA-839m-gpw8-59j4", "source": "security-advisories@github.com"}, {"url": "https://mybb.com/versions/1.8.40", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40."}], "lastModified": "2026-09-08T21:02:26.047", "sourceIdentifier": "security-advisories@github.com"}