What is CVE-2026-45120?

CVE-2026-45120 is a medium-severity vulnerability in Mybb, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.4/10. Published 2026-08-18.

How severe is CVE-2026-45120?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in Mybb

CVE-2026-45120

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Mybb — versions < 1.8.40

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-45120?: CVE-2026-45120 is a medium-severity vulnerability in Mybb, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.4/10. Published 2026-08-18.
How severe is CVE-2026-45120?: Medium severity. CVSS v3 base score is 5.4 out of 10.