MyBB Limited ACP to Full Admin Privilege Escalation via gid=4 User Creation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.