MyBB Limited ACP to Full Admin Privilege Escalation via user-users Module

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•6

This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.