CVE-2026-45119

Received Received - Intake

Admin CP UTF-8 Conversion Module Table Encoding Alteration

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-45119

EUVD

EUVD-2026-61009

Affected Vendors & Products

Vendor	Product	Version / Range
mybb	mybb	to 1.8.40 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects MyBB forum software versions before 1.8.40. It involves the Admin CP UTF-8 Conversion module not validating requests properly, allowing attackers to alter database table encoding and cause service denial via a crafted URL. The issue occurs because GET requests trigger ALTER TABLE operations without verification.

Detection Guidance

This vulnerability can be detected by checking the MyBB version installed on your system. If the version is below 1.8.40, the system is vulnerable. No specific commands are provided in the context to detect exploitation attempts.

Impact Analysis

An attacker could exploit this to modify database tables, potentially disrupting forum functionality or causing data corruption. The attack requires being on the same site and may lead to temporary unavailability of the forum.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves a CSRF issue in MyBB's Admin CP UTF-8 conversion module. The impact is limited to unauthorized table encoding changes and service disruption in MyBB installations prior to version 1.8.40.

Mitigation Strategies

Immediately upgrade MyBB to version 1.8.40 or later to address the vulnerability. Ensure all installations are updated to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-45119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70