CVE-2026-45127 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass Mail, Mass Mailing Archive duplicates archived mailing entries into new drafts with mybb_massemails.status set to 0 on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Mass Mail → Mass Mailing Archive, mybb_massemails.status = 0, and admin/modules/user/mass_mail.php. This issue is fixed in version 1.8.40.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in MyBB versions prior to 1.8.40 represents a critical failure in access control mechanisms within the Administration Control Panel's Mass Mail module. Specifically, this flaw manifests as an Insecure Direct Object Reference combined with Cross-Site Request Forgery characteristics, allowing same-site attackers to manipulate administrative functions without proper authorization checks. The core technical issue lies in the Resend route located under Admin CP, Users & Groups, Mass Mail, and Mass Mailing Archive. This endpoint is designed to duplicate archived mailing entries into new drafts by setting the mybb_massemails.status field to 0. However, this operation is triggered via HTTP GET requests that lack any form of request forgery protection or CSRF tokens. Consequently, an attacker who can trick an authenticated administrator into visiting a maliciously crafted URL can force their browser to execute this action on behalf of the admin, effectively bypassing intended security controls for draft creation and modification within the mass mailing system.
From a technical perspective, the vulnerability exploits the state-changing nature of GET requests in conjunction with predictable object references. By embedding a specially crafted URL that targets specific archived entries where mybb_massemails.status equals 0, an attacker can induce the server to create new drafts based on existing data. This behavior violates standard web application security practices which dictate that actions modifying system state should not be performed via GET requests and must include anti-CSRF protections such as synchronizer tokens or custom headers. The absence of these safeguards allows for automated exploitation where a single click or even an image tag in a phishing email can trigger the vulnerability, provided the victim is logged into the MyBB administration panel at that moment. This lack of validation extends to the uniqueness and integrity checks of the request parameters, enabling unauthorized duplication of sensitive mailing configurations.
The operational impact of this vulnerability is significant for organizations relying on MyBB for community management and internal communications. An attacker can create draft entries from archived data without authorization, potentially leading to the leakage of confidential information contained within those drafts if they are subsequently sent or viewed by other administrators. Furthermore, the ability to manipulate mass mail settings could facilitate spam campaigns using the organization's domain reputation, damaging trust with users and potentially resulting in blacklisting of email servers associated with the forum. The attack vector is particularly dangerous because it requires no authentication bypass beyond having a valid session for an admin user, making social engineering or simple link injection effective methods for exploitation. This aligns closely with CWE-352 Cross-Site Request Forgery (CSRF) and CWE-601 URL Redirection to Untrusted Destination, although the primary issue here is the lack of CSRF protection on state-changing GET requests rather than pure redirection.
Mitigation strategies focus primarily on upgrading to MyBB version 1.8.40 or later where this flaw has been addressed by implementing proper request validation and anti-forgery tokens for all administrative actions involving mass mail archives. For environments unable to upgrade immediately, administrators should ensure that the Mass Mail module is disabled if not in active use, restrict access to the Administration Control Panel through IP whitelisting or multi-factor authentication to reduce the risk of session hijacking, and monitor server logs for unusual GET requests targeting the admin/modules/user/mass_mail.php endpoint. Additionally, implementing a Web Application Firewall with robust CSRF detection capabilities can provide an additional layer of defense by blocking suspicious request patterns that lack required security headers. Regular audits of administrative actions and enforcing strict HTTP method policies where POST or PUT methods are mandated for state changes will further harden the application against similar vulnerabilities in the future.