CVE-2023-41362
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
Risk Assessment
The organization may be exposed to attacks that allow malicious code execution by users with high privileges, potentially leading to serious security breaches.
Recommendation
It is recommended to update MyBB to version 1.8.36 or later to mitigate this vulnerability and review user permissions in the system.
Other vulnerabilities in MyBB
See all- CVE-2017-7566High
MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.
- CVE-2026-45118Critical
MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.
- CVE-2026-45117Critical
MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.
- CVE-2026-47245Medium
MyBB, free and open source forum software, before version 1.8.40 in the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. Deleting an entry from the acting user's list updates the target account's buddy list, but the reciprocal search uses the deleted target UID instead of the acting user's UID, and the unchecked array_search() return value can be used as an array key, potentially removing the target account's first stored buddy.
- CVE-2026-46482Medium
The registration component in MyBB does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. The question_id field is accepted without verifying if the identifier is valid, and if it is blank, forged, or expired, the request continues without a question-related error.
- CVE-2026-45734Medium
MyBB before version 1.8.40 does not consistently enforce single-use semantics for the built-in CAPTCHA, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the default CAPTCHA.
- CVE-2026-45129Medium
MyBB before version 1.8.40 in the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The action=recovery_codes page regenerates Two-Factor Authentication recovery codes on GET requests without request forgery protection.
- CVE-2026-45128Low
MyBB prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control changes the administrator's default view on GET requests without request forgery protection.
- CVE-2026-45127Low
MyBB prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route duplicates archived mailing entries into new drafts on GET requests without request forgery protection.
- CVE-2026-45126Low
MyBB prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions without verifying the my_post_key token.
Original NVD description (English source)
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.