PT-2025-23536 · Mybb · Mybb

Dvz · Published 2025-06-02 · Updated 2025-06-02 · CVE-2025-48941

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.39

Description The search component in MyBB does not validate permissions correctly, allowing attackers to determine the existence of hidden threads, including draft, unapproved, or soft-deleted threads, by analyzing the search results. The mybb threads.visible integer column is not validated in internal search queries, which can be used to output a general success or failure of the search. This issue can be exploited by users with access to the search functionality and general access to forums containing the threads. The vulnerability does not expose the message content of posts.

Recommendations For MyBB versions prior to 1.8.39, update to version 1.8.39 to resolve the issue. As a temporary workaround, consider restricting access to the search functionality to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2025-48941

GHSA-F847-57XC-FFWR

Affected Products

Mybb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48941.json · Exploit
• https://github.com/mybb/mybb/commit/b8cc332a27e145c33effaccec90e23c103ae5193 · Patch
• https://github.com/mybb/mybb/security/advisories/GHSA-f847-57xc-ffwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48941 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48941 · Vendor Advisory
• https://t.me/cvetracker/25195 · Telegram Post
• https://mybb.com/versions/1.8.39 · Note
• https://twitter.com/CVEnew/status/1929573750476873916 · Twitter Post