Search
Find a vulnerability
Search criteria
318 vulnerabilities found for mybb by mybb
CVE-2026-47245 (GCVE-0-2026-47245)
Vulnerability from nvd – Published: 2026-08-18 15:51 – Updated: 2026-08-18 17:37
VLAI
EPSS
VEX
Title
MyBB: Buddy list corruption
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account's first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:37 UTC
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/0557718f27503… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47245",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:37:14.548923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:37:22.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user\u0027s list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user\u0027s UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account\u0027s first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252: Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:51:33.857Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-w8gm-j57p-jqpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-w8gm-j57p-jqpc"
},
{
"name": "https://github.com/mybb/mybb/commit/0557718f27503034fb1c2768729a2fb8239bba65",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/0557718f27503034fb1c2768729a2fb8239bba65"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-w8gm-j57p-jqpc",
"discovery": "UNKNOWN"
},
"title": "MyBB: Buddy list corruption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47245",
"datePublished": "2026-08-18T15:51:33.857Z",
"dateReserved": "2026-05-18T22:54:18.272Z",
"dateUpdated": "2026-08-18T17:37:22.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46482 (GCVE-0-2026-46482)
Vulnerability from nvd – Published: 2026-08-18 15:44 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
MyBB: Security Question insufficient validation
Summary
### Impact
The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value.
[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
### Details
The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error.
### Patches
MyBB 1.8.(...) resolves this issue with the following changes:
- Commit: https://github.com/mybb/mybb/commit/
- `.patch`: https://github.com/mybb/mybb/commit/.patch
### References
- Release Notes: https://mybb.com/versions/1.8.(...)/
### For more information
Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB.
### Contact
The security team can be reached at [security@mybb.com](mailto:security@mybb.com).
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:44 UTC
CWE
- CWE-636 - Not Failing Securely ('Failing Open')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/bd2a3447939d3… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:44:40.432629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:31.511Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "### Impact\nThe registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value.\n\n\n[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n### Details\nThe public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` \u2014 expected to match the question session identifier (`mybb_questionsessions.sid`) \u2014 and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error.\n\n### Patches\nMyBB 1.8.(...) resolves this issue with the following changes:\n\n- Commit: https://github.com/mybb/mybb/commit/\n - `.patch`: https://github.com/mybb/mybb/commit/.patch\n\n### References\n- Release Notes: https://mybb.com/versions/1.8.(...)/\n\n### For more information\nGo to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB.\n\n### Contact\nThe security team can be reached at [security@mybb.com](mailto:security@mybb.com)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:44:59.644Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-v2h7-4jp7-j6hh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-v2h7-4jp7-j6hh"
},
{
"name": "https://github.com/mybb/mybb/commit/bd2a3447939d3084a5926dd66ece04649e0e0d60",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/bd2a3447939d3084a5926dd66ece04649e0e0d60"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-v2h7-4jp7-j6hh",
"discovery": "UNKNOWN"
},
"title": "MyBB: Security Question insufficient validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46482",
"datePublished": "2026-08-18T15:44:59.644Z",
"dateReserved": "2026-05-14T18:06:06.810Z",
"dateUpdated": "2026-08-18T17:46:31.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45734 (GCVE-0-2026-45734)
Vulnerability from nvd – Published: 2026-08-18 15:51 – Updated: 2026-08-19 14:43
VLAI
EPSS
VEX
Title
MyBB: Default CAPTCHA missing invalidation
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:43 UTC
CWE
- CWE-837 - Improper Enforcement of a Single, Unique Action
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/c2ed54f9259b9… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:43:20.441189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:43:38.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-837",
"description": "CWE-837: Improper Enforcement of a Single, Unique Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:51:07.257Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-jrrr-f3jw-mjmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-jrrr-f3jw-mjmc"
},
{
"name": "https://github.com/mybb/mybb/commit/c2ed54f9259b9ce05728a9e657169033fe4adffc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/c2ed54f9259b9ce05728a9e657169033fe4adffc"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-jrrr-f3jw-mjmc",
"discovery": "UNKNOWN"
},
"title": "MyBB: Default CAPTCHA missing invalidation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45734",
"datePublished": "2026-08-18T15:51:07.257Z",
"dateReserved": "2026-05-13T05:51:48.667Z",
"dateUpdated": "2026-08-19T14:43:38.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45129 (GCVE-0-2026-45129)
Vulnerability from nvd – Published: 2026-08-18 15:53 – Updated: 2026-08-18 18:57
VLAI
EPSS
VEX
Title
MyBB: ACP Recovery Codes CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:57 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/d2d9e47b53d85… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:57:37.690351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:57:46.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator\u0027s recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:53:03.385Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9"
},
{
"name": "https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-75vg-6wgp-mcc9",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP Recovery Codes CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45129",
"datePublished": "2026-08-18T15:53:03.385Z",
"dateReserved": "2026-05-08T20:08:17.209Z",
"dateUpdated": "2026-08-18T18:57:46.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45128 (GCVE-0-2026-45128)
Vulnerability from nvd – Published: 2026-08-18 15:43 – Updated: 2026-08-18 17:55
VLAI
EPSS
VEX
Title
MyBB: ACP Users View Manager default CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users & Groups, Users, View Manager changes the administrator's default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:55 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/736a2bcbc7cc1… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45128",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:55:42.819787Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:55:54.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator\u0027s default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users \u0026 Groups, Users, View Manager changes the administrator\u0027s default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users \u0026 Groups \u2192 Users \u2192 View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:43:41.889Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-m6hr-25cj-p58q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-m6hr-25cj-p58q"
},
{
"name": "https://github.com/mybb/mybb/commit/736a2bcbc7cc104df8ae6c0a160aa3917a1ceec0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/736a2bcbc7cc104df8ae6c0a160aa3917a1ceec0"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-m6hr-25cj-p58q",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP Users View Manager default CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45128",
"datePublished": "2026-08-18T15:43:41.889Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:55:54.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45127 (GCVE-0-2026-45127)
Vulnerability from nvd – Published: 2026-08-18 15:38 – Updated: 2026-08-19 14:39
VLAI
EPSS
VEX
Title
MyBB: ACP Mass Mail draft resend CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass Mail, Mass Mailing Archive duplicates archived mailing entries into new drafts with mybb_massemails.status set to 0 on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Mass Mail → Mass Mailing Archive, mybb_massemails.status = 0, and admin/modules/user/mass_mail.php. This issue is fixed in version 1.8.40.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:39 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/a95c5d6730b94… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45127",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:39:33.182695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:39:44.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users \u0026 Groups, Mass Mail, Mass Mailing Archive duplicates archived mailing entries into new drafts with mybb_massemails.status set to 0 on GET requests without request forgery protection. The uniquely identifying implementation details include Users \u0026 Groups \u2192 Mass Mail \u2192 Mass Mailing Archive, mybb_massemails.status = 0, and admin/modules/user/mass_mail.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:38:41.434Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-xx78-g79m-qvgq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-xx78-g79m-qvgq"
},
{
"name": "https://github.com/mybb/mybb/commit/a95c5d6730b943adab7e54bc209c051f98843a3b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/a95c5d6730b943adab7e54bc209c051f98843a3b"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-xx78-g79m-qvgq",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP Mass Mail draft resend CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45127",
"datePublished": "2026-08-18T15:38:41.434Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-19T14:39:44.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45126 (GCVE-0-2026-45126)
Vulnerability from nvd – Published: 2026-08-18 15:47 – Updated: 2026-08-18 18:02
VLAI
EPSS
VEX
Title
MyBB: ACP Questions state CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:00 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/6893b395c7fa3… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45126",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:00:33.448166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:02:06.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:47:09.205Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-m42q-vgx3-fqcc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-m42q-vgx3-fqcc"
},
{
"name": "https://github.com/mybb/mybb/commit/6893b395c7fa3b9e4de6235caea0ce198c376c4f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/6893b395c7fa3b9e4de6235caea0ce198c376c4f"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-m42q-vgx3-fqcc",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP Questions state CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45126",
"datePublished": "2026-08-18T15:47:09.205Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T18:02:06.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45125 (GCVE-0-2026-45125)
Vulnerability from nvd – Published: 2026-08-18 15:50 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
MyBB: Email User CRLF injection
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:44 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/5046c56b515d4… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45125",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:44:38.156362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:25.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:50:38.936Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-f626-53q9-pqm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-f626-53q9-pqm9"
},
{
"name": "https://github.com/mybb/mybb/commit/5046c56b515d4593297a4f65b0c6ccb0b55baa01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/5046c56b515d4593297a4f65b0c6ccb0b55baa01"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-f626-53q9-pqm9",
"discovery": "UNKNOWN"
},
"title": "MyBB: Email User CRLF injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45125",
"datePublished": "2026-08-18T15:50:38.936Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:46:25.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45124 (GCVE-0-2026-45124)
Vulnerability from nvd – Published: 2026-08-18 15:52 – Updated: 2026-08-19 14:45
VLAI
EPSS
VEX
Title
MyBB: Mod CP report resolution missing authorization
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:45 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/5cda5f6d183bc… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45124",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:45:20.417443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:45:32.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:52:31.738Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-gfxj-g7w6-6w4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-gfxj-g7w6-6w4v"
},
{
"name": "https://github.com/mybb/mybb/commit/5cda5f6d183bc2cac24f0533e8d3060a9a46cc42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/5cda5f6d183bc2cac24f0533e8d3060a9a46cc42"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-gfxj-g7w6-6w4v",
"discovery": "UNKNOWN"
},
"title": "MyBB: Mod CP report resolution missing authorization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45124",
"datePublished": "2026-08-18T15:52:31.738Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-19T14:45:32.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45123 (GCVE-0-2026-45123)
Vulnerability from nvd – Published: 2026-08-18 15:44 – Updated: 2026-08-18 18:55
VLAI
EPSS
VEX
Title
MyBB: IPv6 SSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:55 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/9cdadbf66f4ce… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:55:46.017873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:55:56.614Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:44:26.555Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-56wr-64wx-5g7j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-56wr-64wx-5g7j"
},
{
"name": "https://github.com/mybb/mybb/commit/9cdadbf66f4cef50019f13aaa8e3470ea6535cb7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/9cdadbf66f4cef50019f13aaa8e3470ea6535cb7"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-56wr-64wx-5g7j",
"discovery": "UNKNOWN"
},
"title": "MyBB: IPv6 SSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45123",
"datePublished": "2026-08-18T15:44:26.555Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T18:55:56.614Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45122 (GCVE-0-2026-45122)
Vulnerability from nvd – Published: 2026-08-18 15:50 – Updated: 2026-08-18 17:54
VLAI
EPSS
VEX
Title
MyBB: Insufficient permission check for calendar event move
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:52 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/86ed2058e7f9a… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:52:37.864441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:54:36.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:50:02.080Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-839m-gpw8-59j4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-839m-gpw8-59j4"
},
{
"name": "https://github.com/mybb/mybb/commit/86ed2058e7f9a2c14828e731f684e997f9bb220c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/86ed2058e7f9a2c14828e731f684e997f9bb220c"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-839m-gpw8-59j4",
"discovery": "UNKNOWN"
},
"title": "MyBB: Insufficient permission check for calendar event move"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45122",
"datePublished": "2026-08-18T15:50:02.080Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:54:36.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45121 (GCVE-0-2026-45121)
Vulnerability from nvd – Published: 2026-08-18 15:45 – Updated: 2026-08-18 18:50
VLAI
EPSS
VEX
Title
MyBB: Insufficient permission check for calendar select
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:50 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/78e07fea34a6f… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:50:05.374697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:50:21.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:45:29.958Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-r25v-7pcm-q34p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-r25v-7pcm-q34p"
},
{
"name": "https://github.com/mybb/mybb/commit/78e07fea34a6f6c326e668526bfb8e451c19e966",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/78e07fea34a6f6c326e668526bfb8e451c19e966"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-r25v-7pcm-q34p",
"discovery": "UNKNOWN"
},
"title": "MyBB: Insufficient permission check for calendar select"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45121",
"datePublished": "2026-08-18T15:45:29.958Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T18:50:21.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45120 (GCVE-0-2026-45120)
Vulnerability from nvd – Published: 2026-08-18 15:52 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
MyBB: Insufficient authorization for private calendar events
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/c077e6c297551… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:19:13.557606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:20.052Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:52:03.093Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-c2hm-g9w6-pv6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-c2hm-g9w6-pv6x"
},
{
"name": "https://github.com/mybb/mybb/commit/c077e6c29755187c4df78a1e674dd61bc55701b3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/c077e6c29755187c4df78a1e674dd61bc55701b3"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-c2hm-g9w6-pv6x",
"discovery": "UNKNOWN"
},
"title": "MyBB: Insufficient authorization for private calendar events"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45120",
"datePublished": "2026-08-18T15:52:03.093Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:46:20.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45119 (GCVE-0-2026-45119)
Vulnerability from nvd – Published: 2026-08-18 15:49 – Updated: 2026-08-19 14:41
VLAI
EPSS
VEX
Title
MyBB: ACP UTF-8 Conversion CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:40 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/70d445d14c835… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:40:56.896930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:41:09.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:49:14.763Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-p48q-4vgf-q7x8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-p48q-4vgf-q7x8"
},
{
"name": "https://github.com/mybb/mybb/commit/70d445d14c8350cc014be66f7874611abef70ab4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/70d445d14c8350cc014be66f7874611abef70ab4"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-p48q-4vgf-q7x8",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP UTF-8 Conversion CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45119",
"datePublished": "2026-08-18T15:49:14.763Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-19T14:41:09.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45118 (GCVE-0-2026-45118)
Vulnerability from nvd – Published: 2026-08-18 15:55 – Updated: 2026-08-18 17:52
VLAI
EPSS
VEX
Title
MyBB: Contact page reflected XSS
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:47 UTC
CWE
- CWE-83 - Improper Neutralization of Script in Attributes in a Web Page
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:47:24.986811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:52:25.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-\u003einput[\u0027from\u0027] or the Referer HTTP header in $_SERVER[\u0027HTTP_REFERER\u0027] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don\u0027t want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:55:27.280Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-wf92-5q5h-qr53",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-wf92-5q5h-qr53"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-wf92-5q5h-qr53",
"discovery": "UNKNOWN"
},
"title": "MyBB: Contact page reflected XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45118",
"datePublished": "2026-08-18T15:55:27.280Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T17:52:25.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45117 (GCVE-0-2026-45117)
Vulnerability from nvd – Published: 2026-08-18 15:53 – Updated: 2026-08-18 18:58
VLAI
EPSS
VEX
Title
MyBB: Installer database configuration RCE
Summary
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:58 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/0fe713e3b964b… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:58:15.297297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:58:22.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:53:29.914Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-gpc4-77rp-3xqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-gpc4-77rp-3xqr"
},
{
"name": "https://github.com/mybb/mybb/commit/0fe713e3b964bfc878ea65bdd9f746f585f6ebbf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/0fe713e3b964bfc878ea65bdd9f746f585f6ebbf"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-gpc4-77rp-3xqr",
"discovery": "UNKNOWN"
},
"title": "MyBB: Installer database configuration RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45117",
"datePublished": "2026-08-18T15:53:29.914Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T18:58:22.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45116 (GCVE-0-2026-45116)
Vulnerability from nvd – Published: 2026-08-18 15:46 – Updated: 2026-08-18 17:55
VLAI
EPSS
VEX
Title
MyBB: Profile field type confusion XSS
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/c32f0c22baab7… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:55:09.371549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:55:31.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:46:34.212Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-4p6g-p3qh-559v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-4p6g-p3qh-559v"
},
{
"name": "https://github.com/mybb/mybb/commit/c32f0c22baab704a68b8d58fcdd2f26fadbbe19b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/c32f0c22baab704a68b8d58fcdd2f26fadbbe19b"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-4p6g-p3qh-559v",
"discovery": "UNKNOWN"
},
"title": "MyBB: Profile field type confusion XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45116",
"datePublished": "2026-08-18T15:46:34.212Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T17:55:31.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45115 (GCVE-0-2026-45115)
Vulnerability from nvd – Published: 2026-08-18 15:46 – Updated: 2026-08-18 17:55
VLAI
EPSS
VEX
Title
MyBB: Buddy/ignore list username XSS
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:55:15.036117Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:55:22.351Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:46:00.862Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-p766-qqxv-rfc2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-p766-qqxv-rfc2"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-p766-qqxv-rfc2",
"discovery": "UNKNOWN"
},
"title": "MyBB: Buddy/ignore list username XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45115",
"datePublished": "2026-08-18T15:46:00.862Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T17:55:22.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45118 (GCVE-0-2026-45118)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:55 – Updated: 2026-08-18 17:52
VLAI
EPSS
VEX
Title
MyBB: Contact page reflected XSS
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:47 UTC
CWE
- CWE-83 - Improper Neutralization of Script in Attributes in a Web Page
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:47:24.986811Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:52:25.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-\u003einput[\u0027from\u0027] or the Referer HTTP header in $_SERVER[\u0027HTTP_REFERER\u0027] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don\u0027t want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:55:27.280Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-wf92-5q5h-qr53",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-wf92-5q5h-qr53"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-wf92-5q5h-qr53",
"discovery": "UNKNOWN"
},
"title": "MyBB: Contact page reflected XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45118",
"datePublished": "2026-08-18T15:55:27.280Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T17:52:25.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45117 (GCVE-0-2026-45117)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:53 – Updated: 2026-08-18 18:58
VLAI
EPSS
VEX
Title
MyBB: Installer database configuration RCE
Summary
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:58 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/0fe713e3b964b… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:58:15.297297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:58:22.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:53:29.914Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-gpc4-77rp-3xqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-gpc4-77rp-3xqr"
},
{
"name": "https://github.com/mybb/mybb/commit/0fe713e3b964bfc878ea65bdd9f746f585f6ebbf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/0fe713e3b964bfc878ea65bdd9f746f585f6ebbf"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-gpc4-77rp-3xqr",
"discovery": "UNKNOWN"
},
"title": "MyBB: Installer database configuration RCE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45117",
"datePublished": "2026-08-18T15:53:29.914Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T18:58:22.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45129 (GCVE-0-2026-45129)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:53 – Updated: 2026-08-18 18:57
VLAI
EPSS
VEX
Title
MyBB: ACP Recovery Codes CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:57 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/d2d9e47b53d85… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:57:37.690351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:57:46.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator\u0027s recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:53:03.385Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9"
},
{
"name": "https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-75vg-6wgp-mcc9",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP Recovery Codes CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45129",
"datePublished": "2026-08-18T15:53:03.385Z",
"dateReserved": "2026-05-08T20:08:17.209Z",
"dateUpdated": "2026-08-18T18:57:46.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45124 (GCVE-0-2026-45124)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:52 – Updated: 2026-08-19 14:45
VLAI
EPSS
VEX
Title
MyBB: Mod CP report resolution missing authorization
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:45 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/5cda5f6d183bc… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45124",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:45:20.417443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:45:32.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:52:31.738Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-gfxj-g7w6-6w4v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-gfxj-g7w6-6w4v"
},
{
"name": "https://github.com/mybb/mybb/commit/5cda5f6d183bc2cac24f0533e8d3060a9a46cc42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/5cda5f6d183bc2cac24f0533e8d3060a9a46cc42"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-gfxj-g7w6-6w4v",
"discovery": "UNKNOWN"
},
"title": "MyBB: Mod CP report resolution missing authorization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45124",
"datePublished": "2026-08-18T15:52:31.738Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-19T14:45:32.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45120 (GCVE-0-2026-45120)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:52 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
MyBB: Insufficient authorization for private calendar events
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/c077e6c297551… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:19:13.557606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:20.052Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:52:03.093Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-c2hm-g9w6-pv6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-c2hm-g9w6-pv6x"
},
{
"name": "https://github.com/mybb/mybb/commit/c077e6c29755187c4df78a1e674dd61bc55701b3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/c077e6c29755187c4df78a1e674dd61bc55701b3"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-c2hm-g9w6-pv6x",
"discovery": "UNKNOWN"
},
"title": "MyBB: Insufficient authorization for private calendar events"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45120",
"datePublished": "2026-08-18T15:52:03.093Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:46:20.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47245 (GCVE-0-2026-47245)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:51 – Updated: 2026-08-18 17:37
VLAI
EPSS
VEX
Title
MyBB: Buddy list corruption
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account's first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:37 UTC
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/0557718f27503… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47245",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:37:14.548923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:37:22.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user\u0027s list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user\u0027s UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account\u0027s first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252: Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:51:33.857Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-w8gm-j57p-jqpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-w8gm-j57p-jqpc"
},
{
"name": "https://github.com/mybb/mybb/commit/0557718f27503034fb1c2768729a2fb8239bba65",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/0557718f27503034fb1c2768729a2fb8239bba65"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-w8gm-j57p-jqpc",
"discovery": "UNKNOWN"
},
"title": "MyBB: Buddy list corruption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47245",
"datePublished": "2026-08-18T15:51:33.857Z",
"dateReserved": "2026-05-18T22:54:18.272Z",
"dateUpdated": "2026-08-18T17:37:22.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45734 (GCVE-0-2026-45734)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:51 – Updated: 2026-08-19 14:43
VLAI
EPSS
VEX
Title
MyBB: Default CAPTCHA missing invalidation
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:43 UTC
CWE
- CWE-837 - Improper Enforcement of a Single, Unique Action
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/c2ed54f9259b9… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:43:20.441189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:43:38.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-837",
"description": "CWE-837: Improper Enforcement of a Single, Unique Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:51:07.257Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-jrrr-f3jw-mjmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-jrrr-f3jw-mjmc"
},
{
"name": "https://github.com/mybb/mybb/commit/c2ed54f9259b9ce05728a9e657169033fe4adffc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/c2ed54f9259b9ce05728a9e657169033fe4adffc"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-jrrr-f3jw-mjmc",
"discovery": "UNKNOWN"
},
"title": "MyBB: Default CAPTCHA missing invalidation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45734",
"datePublished": "2026-08-18T15:51:07.257Z",
"dateReserved": "2026-05-13T05:51:48.667Z",
"dateUpdated": "2026-08-19T14:43:38.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45125 (GCVE-0-2026-45125)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:50 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
MyBB: Email User CRLF injection
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:44 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/5046c56b515d4… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45125",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:44:38.156362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:25.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:50:38.936Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-f626-53q9-pqm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-f626-53q9-pqm9"
},
{
"name": "https://github.com/mybb/mybb/commit/5046c56b515d4593297a4f65b0c6ccb0b55baa01",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/5046c56b515d4593297a4f65b0c6ccb0b55baa01"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-f626-53q9-pqm9",
"discovery": "UNKNOWN"
},
"title": "MyBB: Email User CRLF injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45125",
"datePublished": "2026-08-18T15:50:38.936Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:46:25.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45122 (GCVE-0-2026-45122)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:50 – Updated: 2026-08-18 17:54
VLAI
EPSS
VEX
Title
MyBB: Insufficient permission check for calendar event move
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:52 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/86ed2058e7f9a… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:52:37.864441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:54:36.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:50:02.080Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-839m-gpw8-59j4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-839m-gpw8-59j4"
},
{
"name": "https://github.com/mybb/mybb/commit/86ed2058e7f9a2c14828e731f684e997f9bb220c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/86ed2058e7f9a2c14828e731f684e997f9bb220c"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-839m-gpw8-59j4",
"discovery": "UNKNOWN"
},
"title": "MyBB: Insufficient permission check for calendar event move"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45122",
"datePublished": "2026-08-18T15:50:02.080Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T17:54:36.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45119 (GCVE-0-2026-45119)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:49 – Updated: 2026-08-19 14:41
VLAI
EPSS
VEX
Title
MyBB: ACP UTF-8 Conversion CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40.
Severity
4.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:40 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/70d445d14c835… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:40:56.896930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:41:09.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:49:14.763Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-p48q-4vgf-q7x8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-p48q-4vgf-q7x8"
},
{
"name": "https://github.com/mybb/mybb/commit/70d445d14c8350cc014be66f7874611abef70ab4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/70d445d14c8350cc014be66f7874611abef70ab4"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-p48q-4vgf-q7x8",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP UTF-8 Conversion CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45119",
"datePublished": "2026-08-18T15:49:14.763Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-19T14:41:09.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45126 (GCVE-0-2026-45126)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:47 – Updated: 2026-08-18 18:02
VLAI
EPSS
VEX
Title
MyBB: ACP Questions state CSRF
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 18:00 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/6893b395c7fa3… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45126",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T18:00:33.448166Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T18:02:06.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:47:09.205Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-m42q-vgx3-fqcc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-m42q-vgx3-fqcc"
},
{
"name": "https://github.com/mybb/mybb/commit/6893b395c7fa3b9e4de6235caea0ce198c376c4f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/6893b395c7fa3b9e4de6235caea0ce198c376c4f"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-m42q-vgx3-fqcc",
"discovery": "UNKNOWN"
},
"title": "MyBB: ACP Questions state CSRF"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45126",
"datePublished": "2026-08-18T15:47:09.205Z",
"dateReserved": "2026-05-08T20:08:17.208Z",
"dateUpdated": "2026-08-18T18:02:06.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45116 (GCVE-0-2026-45116)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:46 – Updated: 2026-08-18 17:55
VLAI
EPSS
VEX
Title
MyBB: Profile field type confusion XSS
Summary
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:55 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/mybb/mybb/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/mybb/mybb/commit/c32f0c22baab7… | x_refsource_MISC |
| https://github.com/mybb/mybb/releases/tag/mybb_1840 | x_refsource_MISC |
| https://mybb.com/versions/1.8.40 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:55:09.371549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:55:31.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mybb",
"vendor": "mybb",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.40"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:46:34.212Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/mybb/mybb/security/advisories/GHSA-4p6g-p3qh-559v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mybb/mybb/security/advisories/GHSA-4p6g-p3qh-559v"
},
{
"name": "https://github.com/mybb/mybb/commit/c32f0c22baab704a68b8d58fcdd2f26fadbbe19b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/commit/c32f0c22baab704a68b8d58fcdd2f26fadbbe19b"
},
{
"name": "https://github.com/mybb/mybb/releases/tag/mybb_1840",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
},
{
"name": "https://mybb.com/versions/1.8.40",
"tags": [
"x_refsource_MISC"
],
"url": "https://mybb.com/versions/1.8.40"
}
],
"source": {
"advisory": "GHSA-4p6g-p3qh-559v",
"discovery": "UNKNOWN"
},
"title": "MyBB: Profile field type confusion XSS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45116",
"datePublished": "2026-08-18T15:46:34.212Z",
"dateReserved": "2026-05-08T20:08:17.207Z",
"dateUpdated": "2026-08-18T17:55:31.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}