A privilege escalation vulnerability in MyBB 1.8.40 allows limited administrative users to gain full control of the application through unrestricted usergroup assignment.

This is a privilege escalation flaw where an authenticated user with limited Admin Control Panel access can assign their own account to the Administrators group. The issue stems from a failure to perform proper validation on usergroup assignment operations.

With a CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and confidentiality of the forum environment. A successful exploit allows a low-privileged user to gain full administrative control, enabling them to compromise user data, modify forum configurations, or potentially execute arbitrary code depending on the administrative features enabled, leading to a complete system takeover.

Immediate Action: Audit all administrative user accounts and revoke permissions for any users who do not strictly require them until a vendor-supplied patch is available.

Proactive Monitoring: Review administrative audit logs for any unauthorized changes to usergroup assignments or account permissions, particularly those involving administrative groups.

Compensating Controls: Implement strict Access Control Lists (ACL) for the Admin Control Panel and ensure that sensitive administrative functions are restricted to a limited, highly trusted set of users via multi-factor authentication where possible.

Public Exploit Available: true

Given the availability of a public exploit, the risk of privilege escalation is severe. Administrators must immediately review and restrict access to the Admin Control Panel to prevent low-privileged users from escalating their access. Maintain strict vigilance over user account changes until a permanent patch is released by the vendor.