MyBB Limited ACP Account Privilege Escalation to Administrator

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new user account with administrator privileges (group 4). This rule identifies when an account with limited management permissions exploits the ACP to assign a new user to the administrator group, effectively bypassing intended permission restrictions.