MyBB 1.8.40 Privilege Escalation Lets Limited Admins Gain Full ACP Access

A privilege-boundary flaw in MyBB 1.8.40 allows an Admin Control Panel account with only limited user-management rights to create a new user in the full Administrator group and escalate to unrestricted administrative access. The issue affects the Admin CP add-user workflow, where administrator-capable groups are exposed to lower-privileged admins and submitted group values are accepted without an effective authorization check, enabling creation of an account with gid=4 and access to modules that were previously denied.

A public proof of concept published on GitHub said the behavior was verified on a fresh MyBB 1.8.40 installation, showing that a non-super admin could promote a newly created account into the top administrator role. The reported impact includes full MyBB application administration, such as changing configuration, modifying permissions, managing users, and altering themes, templates, and other persistence-relevant settings. The researcher recommended blocking limited ACP users from assigning ACP-capable groups in add-user, edit-user, and bulk-update flows, and enforcing group-grant restrictions inside UserDataHandler::verify_usergroup().