CyberRota Analysis
AI-GeneratedThe MyBB forum software's calendar module prior to version 1.8.40 is vulnerable due to insufficient validation of moderation permissions when moving events between calendars. This flaw allows users with moderation rights on a source calendar to move events to a destination calendar where they only have viewing permissions, potentially leading to unauthorized access to sensitive event information. Organizations using MyBB should prioritize upgrading to version 1.8.40 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.