MyBB Community Forums

If a password protected forum has an announcement, users can access it directly by giving the announcements.php?aid=x URL. forumdisplay and showthread call the check_password function for the forum, announcement.php does not.

in announcement.php find:

if($forumpermissions['canview'] == 0 || $forumpermissions['canviewthreads'] == 0)
{
	error_no_permission();
}

Add after:

// Check if this forum is password protected and we have a valid password
check_forum_password($forum['fid']);

Thank you for your bug report.

This bug has been fixed in our internal code repository. Please note that the problem will not be fixed here until these forums are updated.

With regards,
MyBB Group