Loading story…
A privilege-boundary flaw in MyBB 1.8.40 allows an Admin Control Panel account with only limited user-management rights to create a new user in the full Administrator group and escalate to unrestricted administrative access. The issue affects the Admin CP add-user workflow, where administrator-capable groups are exposed to lower-privileged admins and submitted group values are accepted without an effective authorization check, enabling creation of an account with gid=4 and access to modules that were previously denied.
A public proof of concept published on GitHub said the behavior was verified on a fresh MyBB 1.8.40 installation, showing that a non-super admin could promote a newly created account into the top administrator role. The reported impact includes full MyBB application administration, such as changing configuration, modifying permissions, managing users, and altering themes, templates, and other persistence-relevant settings. The researcher recommended blocking limited ACP users from assigning ACP-capable groups in add-user, edit-user, and bulk-update flows, and enforcing group-grant restrictions inside UserDataHandler::verify_usergroup().
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
On a fresh MyBB 1.8.40 installation, a researcher verified that a non-super Admin CP account with only user-management permissions could create a new account in the Administrator group and gain full administrator capabilities. The test on 18 June 2026 confirmed the source account was denied access to config-settings before exploitation, while the newly created gid=4 account could access previously denied modules afterward.
MyBB version 1.8.40 was released. Later reporting states this version contained the limited-ACP-to-admin privilege-escalation issue and also patched an older stored XSS issue tracked as CVE-2026-45115.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through **3.3.16** and **4.0.0-a2**, and stems from trust in the `PHP_AUTH_USER` value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using `login_link` and `auth_provider=apache`, causing phpBB to treat supplied credentials as authenticated under affected configurations. Researchers said compromise of an administrator account can lead to **remote code execution** and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in **3.3.17** and advised users of **4.0.0-a2** to move to the development `master` branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.
Jun 29, 2026
phpBB has fixed a long-standing authentication bypass vulnerability that lets attackers log in as any forum user, including administrators, with a single HTTP request. The flaw, discovered by Aikido and reported through phpBB’s HackerOne disclosure program, affects phpBB `3.3.16` and earlier as well as `4.0.0-a2`, spans both the 3.x and 4.x branches, and reportedly existed for about 10 years. Researchers said the bug requires no special configuration and can be exploited against default deployments. Successful exploitation could allow attackers to read private messages, manipulate forum content and user accounts, impersonate moderators or administrators, and deface forums. phpBB released a fix for the 3.x branch in version `3.3.17`, while no patched 4.x release was available at the time of reporting. Aikido withheld technical details to give administrators time to update and separately warned operators of large phpBB forums; researchers also noted that remote code execution is not possible because the Admin Control Panel enforces a separate password check.
Jul 3, 2026
A critical vulnerability, **CVE-2025-14533**, was disclosed in the WordPress plugin *Advanced Custom Fields: Extended* affecting versions **<= 0.9.2.1**. The issue is an **unauthenticated privilege escalation** in the plugin’s user-form handling, where the `insert_user` logic does not properly restrict which roles can be assigned during registration; as a result, an attacker can submit a registration request specifying the **`administrator`** role and obtain full administrative access under certain configurations. Reporting indicates exploitation depends on site configuration: the flaw is reachable when a form is set up such that the **`role`** value is mapped to a custom field / user role field is present in the form. The weakness was identified by **Andrea Bocchetti** via the **Wordfence Bug Bounty Program**, and is associated with **CWE-269 (Improper Privilege Management)**; once admin access is obtained, attackers can fully compromise the site (e.g., upload malicious plugins/themes, plant backdoors, or alter content for redirects).
Jun 29, 2026