MyBB's public forum and its Admin Control Panel are separate application paths. The forum can require a login while the Admin CP still has an exposed installer, a weak administrator recovery path, or an administrator account without a second factor.
On 2026-10-31 at 21:55 UTC, one count-only ZoomEye query returned 377 matches:
app="MyBB" || title="MyBB"
The query used sub_type=all, page 1, and page size 1. It does not establish that a matching forum has an exposed Admin CP or a specific security setting. The result is a focused inventory list, not a vulnerability count.
Remove or lock the installer
The MyBB directory-structure documentation identifies install/ as installer and upgrade files that should be removed after use. It also notes that the admin directory can be renamed in configuration and that internal source and backup locations should not be remotely accessible.
Check the deployed web root for install/, admin/, backup files, and configuration examples. A renamed admin directory can reduce opportunistic discovery, but it is not an authentication control. The Admin CP must still require its own login and strong administrator protections.
Use the documented lock or removal process for the installer. Do not leave an old upgrade directory in place after a release. Confirm that a direct request to the installation path does not expose a setup workflow or version-specific upgrade page.
Require a strong administrator factor
The MyBB two-factor authentication guide describes enabling 2FA from an administrator's preferences and saving backup codes. It states that the feature is available to administrator accounts in the Admin CP.
The MyBB security guide recommends 2FA for forum administrators, restricting Admin CP access, reviewing admin permissions, and considering an additional HTTP Basic Auth layer. It also describes a Secret PIN as an additional control.
Do not treat a separate front-end login as protection for the Admin CP. Test the administrator login directly. Confirm which accounts are Super Administrators and whether their permissions follow the least-privilege model described in the guide.
Inventory the recovery path
The MyBB login-problems documentation describes recovery actions that use configuration files or database commands. Those procedures are useful for an owner with server access, but they create an alternate way to change administrator state.
Restrict database and file access to controlled administrators. Rotate credentials used in recovery procedures and keep them out of support tickets. Confirm that an attacker who can reach only the web application cannot invoke the recovery path. Review administrator session invalidation after a password or second-factor change.
Test the public-to-admin boundary
Use a controlled test forum:
- 1.
Request the installer path after setup.
- 2.
Request the Admin CP without an administrator session.
- 3.
Attempt a non-administrator account against the Admin CP.
- 4.
Sign in with an administrator account and verify 2FA.
- 5.
Review the effective administrator permissions.
- 6.
Rename the admin directory and confirm the configured path.
Record the URL, account role, authentication result, and setting. Do not record passwords, backup codes, or session cookies.
The 377 matches can help an owner find an unregistered MyBB forum. They cannot prove that an administrator account is exposed. The security conclusion should come from the web-root review, Admin CP configuration, and a controlled login test.