PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9403 Mybb CVE debrief

CVE-2016-9403 affects MyBB and MyBB Merge System before 1.8.7. NVD describes a missing permission check in newreply.php that allows remote attackers to have unspecified impact. The NVD CVSS vector rates the issue as critical, with network access, no privileges, and no user interaction required.

Vendor
Mybb
Product
CVE-2016-9403
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and operators of MyBB forums, sites running the MyBB Merge System, and teams responsible for public-facing web applications should treat this as urgent if any instance is still on 1.8.6 or earlier.

Technical summary

NVD lists vulnerable MyBB and MyBB Merge System versions up to and including 1.8.6. The issue is described as a missing permission check in newreply.php, which can let a remote attacker trigger unspecified impact. The NVD CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a severe remotely reachable flaw.

Defensive priority

Urgent

Recommended defensive actions

  • Upgrade MyBB and MyBB Merge System to 1.8.7 or later.
  • Verify that no public or internal systems are still running version 1.8.6 or earlier.
  • Review access controls around reply and post-creation workflows, especially newreply.php.
  • Inspect forum logs for abnormal or unauthorized reply activity.
  • Use the vendor release notes and advisories referenced by NVD to confirm the fixed release path.

Evidence notes

Source material from NVD and the referenced vendor/advisory links states that MyBB and MyBB Merge System versions through 1.8.6 are vulnerable. The record was published on 2017-01-31 and references Openwall mailing list posts, a SecurityFocus entry, and MyBB 1.8.7 release notes as supporting material. The source description does not further specify the exact impact beyond 'unspecified impact.'

Official resources

Public disclosure is tracked by the CVE publication date of 2017-01-31. NVD references point to vendor release notes and mailing list advisories associated with the 1.8.7 fix cycle.