CVE-2026-45127

Received Received - Intake

Mass Mail Draft Creation in MyBB

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass Mail, Mass Mailing Archive duplicates archived mailing entries into new drafts with mybb_massemails.status set to 0 on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Mass Mail → Mass Mailing Archive, mybb_massemails.status = 0, and admin/modules/user/mass_mail.php. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-45127

EUVD

EUVD-2026-60977

Affected Vendors & Products

Vendor	Product	Version / Range
mybb	mybb	1.8.40

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in MyBB before version 1.8.40 allows same-site attackers to create draft entries from archived entries by exploiting improper request validation in the ACP Mass Mail module. The issue occurs via a crafted URL in the Resend route of the Mass Mailing Archive, which duplicates archived entries into new drafts without request forgery protection.

Detection Guidance

This vulnerability can be detected by checking for unauthorized draft entries created from archived mass mailings in the MyBB Admin Control Panel under Users & Groups > Mass Mail > Mass Mailing Archive. Look for entries with status set to 0 that were not manually created.

Impact Analysis

An attacker could exploit this to create unauthorized draft entries from archived mailings, potentially leading to spam or phishing campaigns being sent from your forum. This could damage your forum's reputation and user trust.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-severity Cross-Site Request Forgery (CSRF) issue in MyBB's Mass Mail module that could allow unauthorized draft creation but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Immediately upgrade MyBB to version 1.8.40 or later to patch the vulnerability. Ensure all Admin Control Panel routes require CSRF protection and review draft entries for signs of unauthorized creation.

Hi! I’m here to help you understand CVE-2026-45127. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70