CVE-2026-47366: Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administra

Synopsis

This is a privilege escalation vulnerability in phpBB's Administration Control Panel (ACP). An authenticated administrator can manipulate permission assignments to grant rights beyond what their account level authorizes, effectively elevating their own or another account's privileges within the admin interface. Exploitation requires network access and a valid administrator account, and successful abuse gives the attacker full control over confidentiality, integrity, and availability of the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The ACP is exposed over the network, so an attacker must be able to reach the phpBB admin interface via a standard HTTP/S connection.

• AuthenticationRequired

  A valid administrator account is required; any admin-level credential is sufficient, even one with limited delegated privileges.

• Victim interactionNot required

  No victim action is needed; the attacker operates entirely through their own authenticated session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental factors to succeed.

Blast Radius

• The attacker reads sensitive administrative data, including user account details, private messages, and configuration secrets stored in the phpBB instance.
• The attacker modifies persisted permission records, user roles, and site configuration, potentially granting arbitrary accounts elevated or full administrative rights.
• The attacker can disrupt or fully take down the phpBB service by altering core settings or deleting critical data.
• Any account whose permissions are manipulated carries the escalated rights forward, meaning the impact persists beyond the initial exploit session.