CVE-2025-48941: mybb · Exposure of Sensitive Information Through Metadata
Affects mybbSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : upgrade to 1.8.39 when convenient.
Data as of 26 Oct 2026, 12:55 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.8.39
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade mybb/mybb to 1.8.39.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubmybb/mybbpkg:github/mybb/mybbOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
European organizations should upgrade all MyBB installations to version 1.8.39 or later, where the vulnerability is fixed. If immediate upgrading is not feasible, administrators can implement the following mitigations: 1) Restrict access to the search functionality to trusted users only, possibly by requiring authentication or limiting search permissions to reduce exposure. 2) Customize or harden the search response behavior to avoid revealing differences in HTTP redirects or messages that could be used as side channels to infer thread existence. 3) Regularly audit forum permissions and visibility settings to ensure that sensitive threads are appropriately protected or archived outside the forum if necessary. 4) Monitor forum logs for unusual search patterns that might indicate probing attempts. 5) Consider deploying web application firewalls (WAFs) with rules to detect and block suspicious search queries targeting thread titles. These steps, combined with prompt patching, will effectively mitigate the risk posed by this vulnerability.
Description
MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displaying the final search results, a search operation that internally produces at least one result outputs a redirect response (as a HTTP redirect, or a success message page with delayed redirect, depending on configuration). On the other hand, a search operation that internally produces no results outputs a corresponding message in the response without a redirect. This allows a user to determine whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), soft-deleted threads (`visible` with a value of `-1`), and unapproved threads (`visible` with a value of `0`); in addition to displaying generally visible threads (`visible` with a value of `1`). This vulnerability does not affect other layers of permissions. In order to exploit the vulnerability, the user must have access to the search functionality, and general access to forums containing the thread(s). The vulnerability does not expose the message content of posts. MyBB 1.8.39 resolves this issue.