Admin-Cp

MyBB 1.8.40 Limited Admin CP User-Manager to Full Administrator Privilege Escalation

A non-super Admin CP account that has only the user-management permission (user-users = 1) can use the standard Admin CP "add user" form to create a brand-new account directly in the Administrator group (gid=4), because the underlying user data handler's…