MyBB Forum Software Vulnerability: Inadequate Permission Validation in Search Functionality

CVE-2025-48941

What is CVE-2025-48941?

MyBB, an open source forum software, is susceptible to a security oversight where its search component fails to correctly validate permissions. This weakness enables attackers to ascertain the existence of hidden threads—including drafts, unapproved content, or soft-deleted threads—by executing searches with specific title text. The internal search queries do not validate the visibility state of threads, allowing a user to determine the presence of such threads based merely on the search results returned. While the software does perform permission checks when displaying search results, the way it handles internal queries leads to the inadvertent exposure of thread visibility statuses. This vulnerability necessitates user access to the search feature and general forum access, but does not reveal the contents of the posts themselves. MyBB version 1.8.39 addresses and resolves this flaw.

References