CVE-2025-48941

MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displaying the final search results, a search operation that internally produces at least one result outputs a redirect response (as a HTTP redirect, or a success message page with delayed redirect, depending on configuration). On the other hand, a search operation that internally produces no results outputs a corresponding message in the response without a redirect. This allows a user to determine whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), soft-deleted threads (`visible` with a value of `-1`), and unapproved threads (`visible` with a value of `0`); in addition to displaying generally visible threads (`visible` with a value of `1`). This vulnerability does not affect other layers of permissions. In order to exploit the vulnerability, the user must have access to the search functionality, and general access to forums containing the thread(s). The vulnerability does not expose the message content of posts. MyBB 1.8.39 resolves this issue.

• CWE-1230

• https://github.com/mybb/mybb/commit/b8cc332a27e145c33effaccec90e23c103ae5193Patch
• https://github.com/mybb/mybb/security/advisories/GHSA-f847-57xc-ffwrVendor Advisory
• https://mybb.com/versions/1.8.39Product, Release Notes

Published

Jun 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48936Zitadel is open-source identity infrastructure software. Pri…8.8
• CVE-2025-48937matrix-rust-sdk is an implementation of a Matrix client-serv…4.9
• CVE-2025-48938go-gh is a collection of Go modules to make authoring GitHub…9.8
• CVE-2025-48939tarteaucitron.js is a compliant and accessible cookie banner…4.2
• CVE-2025-4894A vulnerability classified as problematic was found in calmk…5.9
• CVE-2025-48940MyBB is free and open source forum software. Prior to versio…7.2
• CVE-2025-48942vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48943vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48944vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48945pycares is a Python module which provides an interface to c-…8.2
• CVE-2025-48946liboqs is a C-language cryptographic library that provides i…3.7
• CVE-2025-48947The Auth0 Next.js SDK is a library for implementing user aut…7.7