CVE-2026-45126
Received Received - Intake

CSRF Bypass in MyBB Admin CP Security Questions

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-45126
EUVD
EUVD-2026-61007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb to 1.8.40 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MyBB forum software (before version 1.8.40) involves improper validation of anti-CSRF tokens in the Admin CP Security Questions module. Attackers can exploit this by crafting a URL to enable or disable registration challenge questions without proper authorization.

Detection Guidance

This vulnerability can be detected by checking the MyBB version installed on your system. If the version is below 1.8.40, the system is vulnerable. You can check the version by examining the file admin/modules/config/questions.php or by logging into the Admin CP and checking the version information.

Impact Analysis

An attacker could manipulate registration security questions, potentially allowing unauthorized access to user accounts or disrupting forum functionality. This requires the attacker to be on the same site and have some user interaction.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA. It is a low-severity CSRF issue in MyBB's Admin CP that allows unauthorized state changes to registration questions. No evidence suggests it leads to data breaches or unauthorized access to sensitive user data required for GDPR/HIPAA compliance.

Mitigation Strategies

Immediately upgrade MyBB to version 1.8.40 or later to address the vulnerability. Ensure that the anti-CSRF token validation is properly implemented in the Admin CP Security Questions module.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart