CVE-2026-45120

MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.

MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.

MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.

MyBB, free and open source forum software, before version 1.8.40 in the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. Deleting an entry from the acting user's list updates the target account's buddy list, but the reciprocal search uses the deleted target UID instead of the acting user's UID, and the unchecked array_search() return value can be used as an array key, potentially removing the target account's first stored buddy.

The registration component in MyBB does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. The question_id field is accepted without verifying if the identifier is valid, and if it is blank, forged, or expired, the request continues without a question-related error.

MyBB before version 1.8.40 does not consistently enforce single-use semantics for the built-in CAPTCHA, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the default CAPTCHA.

MyBB before version 1.8.40 in the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The action=recovery_codes page regenerates Two-Factor Authentication recovery codes on GET requests without request forgery protection.

MyBB prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control changes the administrator's default view on GET requests without request forgery protection.

MyBB prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route duplicates archived mailing entries into new drafts on GET requests without request forgery protection.

MyBB prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions without verifying the my_post_key token.