CVE-2025-48941 MyBB may disclosure unviewable threads' titles in searches
Attackers can determine the existence of hidden threads via search response differences, leaking metadata about unapproved or deleted content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48941?
CVE-2025-48941 is a medium-severity vulnerability in Mybb Mybb, published on 2 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displaying the final search results, a search operation that internally produces at least one result outputs a redirect response (as a HTTP redirect, or a success message page with delayed redirect, depending on configuration). On the other hand, a search operation that internally produces no results outputs a corresponding message in the response without a redirect. This allows a user to determine whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), soft-deleted threads (`visible` with a value of `-1`), and unapproved threads (`visible` with a value of `0`); in addition to displaying generally visible threads (`visible` with a value of `1`). This vulnerability does not affect other layers of permissions. In order to exploit the vulnerability, the user must have access to the search functionality, and general access to forums containing the thread(s). The vulnerability does not expose the message content of posts. MyBB 1.8.39 resolves this issue.
Weakness: CWE-1230
Which versions are affected by CVE-2025-48941?
It affects 1 product.
Products include Mybb Mybb.
How do I fix CVE-2025-48941?
No fix has been published for CVE-2025-48941 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-48941 being exploited?
There is no known exploitation of CVE-2025-48941 in the wild and no public exploit code.
Other vulnerabilities in Mybb Mybb
Sources
Also known as GHSA-f847-57xc-ffwr.