MyBB Limited ACP Privilege Escalation to Full Admin (CVE-2026-46331)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•3

Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.