CVE-2026-45119

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/mybb/mybb/commit/70d445d14c8350cc014be66f7874611abef70ab4
https://github.com/mybb/mybb/releases/tag/mybb_1840
https://github.com/mybb/mybb/security/advisories/GHSA-p48q-4vgf-q7x8
https://mybb.com/versions/1.8.40

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-18 16:17

Updated : 2026-09-08 21:02

NVD link : CVE-2026-45119

Mitre link : CVE-2026-45119

CVE.ORG link : CVE-2026-45119

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-45119", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45119", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T14:40:56.896930Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mybb", "product": "mybb", "versions": [{"status": "affected", "version": "< 1.8.40"}]}]}], "published": "2026-08-18T16:17:06.773", "references": [{"url": "https://github.com/mybb/mybb/commit/70d445d14c8350cc014be66f7874611abef70ab4", "source": "security-advisories@github.com"}, {"url": "https://github.com/mybb/mybb/releases/tag/mybb_1840", "source": "security-advisories@github.com"}, {"url": "https://github.com/mybb/mybb/security/advisories/GHSA-p48q-4vgf-q7x8", "source": "security-advisories@github.com"}, {"url": "https://mybb.com/versions/1.8.40", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40."}], "lastModified": "2026-09-08T21:02:26.047", "sourceIdentifier": "security-advisories@github.com"}