MyBB Limited ACP Privilege Escalation to Administrator via usergroup=4 POST

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects a potential privilege escalation attempt in MyBB where a user with limited Administrator Control Panel (ACP) permissions modifies a user account to join the 'Administrator' group (ID 4) by POSTing to the 'user-users' module.