CVE-2026-45128
Received Received - Intake

MyBB Default User List View Change via URL

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users & Groups, Users, View Manager changes the administrator's default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-07
NVD
CVE-2026-45128
EUVD
EUVD-2026-61050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb to 1.8.40 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MyBB before version 1.8.40 allows same-site attackers to change an administrator's default user list view by tricking them into clicking a specially crafted URL. The issue occurs in the ACP Users View Manager module where the Set as Default control changes the view without proper request forgery protection.

Detection Guidance

This vulnerability can be detected by checking if your MyBB installation is running version 1.8.40 or later. If not, the system is vulnerable. Review the Users & Groups → Users → View Manager section in the Admin CP for unauthorized changes to default views.

Impact Analysis

An attacker could manipulate an administrator's view settings, potentially leading to confusion or misconfiguration in user management. While it does not directly expose sensitive data, it could be used as part of a larger attack chain to gain unauthorized access or disrupt forum operations.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it does not involve data exposure or unauthorized access to protected health information. However, improper user management could indirectly affect compliance if it leads to unauthorized administrative actions.

Mitigation Strategies

Immediately update MyBB to version 1.8.40 or later to patch the vulnerability. Ensure request forgery protections are enabled in the Admin CP settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart