MyBB ACP Limited Account Escalation to Admin Group via usergroup=4

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•18

Detects attempts to exploit an authorization bypass vulnerability in MyBB (specifically observed in version 1.8.40) where a non-administrative ACP account can assign users to the administrator group (gid=4) by manipulating POST requests to the user-add or user-edit endpoints.