Vulnerability · Published Jun 12, 2026 · Assigned by hackerone
CVE-2026-47366
High 7.2
In plain English
A high-severity improper access control in phpBB from phpBB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.0)7.2High
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H