MyBB Limited ACP User Escalation to Administrator via usergroup=4 Bypass

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.