CVE-2026-47245
Received Received - Intake

Buddy List Update Flaw in MyBB Forum Software

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account's first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-47245
EUVD
EUVD-2026-61016

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb to 1.8.40 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MyBB before version 1.8.40 allows a user to manipulate the buddy/ignore list system. When a user tries to remove someone from their buddy list, the system incorrectly updates the buddy list of the target user. Instead of removing the correct entry, it may remove the first entry in the target's list due to improper handling of a failed search result.

Detection Guidance

To detect this vulnerability, check MyBB versions prior to 1.8.40 by inspecting the version in the Admin CP or via database query. Look for unexpected buddy list modifications where users report missing entries without their action. Review usercp.php for the described logic flaw in reciprocal updates.

Impact Analysis

An attacker could exploit this to disrupt the buddy list functionality for other users. This could lead to unintended removal of contacts, confusion in user relationships, or potential social engineering attacks by manipulating who appears as a buddy or ignored user.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it involves buddy list corruption in a forum software rather than data breaches or unauthorized access to sensitive information. However, if buddy list data includes personal identifiers, improper handling could potentially lead to privacy concerns under GDPR.

Mitigation Strategies

Upgrade MyBB to version 1.8.40 or later to address the buddy/ignore list validation flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart