CVE-2026-45122
MyBB: Insufficient permission check for calendar event move
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.
| CWE | CWE-863 |
| Vendor | mybb |
| Product | mybb |
| Published | Aug 18, 2026 |
| Last Updated | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for mybb mybb
Be the first to know when new medium vulnerabilities affecting mybb mybb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
mybb / mybb
< 1.8.40