CVE-2026-45128 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users & Groups, Users, View Manager changes the administrator's default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open-source forum software that powers numerous community-driven websites. A significant security flaw was identified within the Admin Control Panel (ACP), specifically affecting the Users View Manager module prior to version 1.8.40. This vulnerability stems from an insufficient validation of incoming requests, which allows same-site attackers to manipulate the state of a victim administrator's session without their explicit consent or knowledge. The core technical flaw lies in the implementation of the Set as Default control, identified by the parameter set_default within the Admin CP under Users & Groups and specifically in the View Manager interface. This functionality is designed to allow administrators to customize their default user list view for convenience but fails to implement adequate request forgery protection mechanisms such as anti-CSRF tokens or strict origin validation on GET requests that modify this setting.
The operational impact of this vulnerability centers on Cross-Site Request Forgery, commonly referred to by its acronym CSRF. Because the state-changing action is triggered via a simple HTTP GET request without additional security checks, an attacker can craft a malicious URL containing specific parameters and embed it within a webpage or email that a targeted administrator might visit while authenticated in their MyBB admin panel. Upon accessing this crafted link, the browser automatically sends the session cookies along with the request to the vulnerable endpoint. This results in the unauthorized modification of the administrator's default view configuration. While the immediate effect may appear limited to UI customization changes, such state-changing actions via GET requests violate fundamental web security principles and can serve as a vector for more severe attacks if combined with other vulnerabilities or used to disrupt administrative workflows.
From a classification perspective, this vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF). The lack of proper validation on state-changing GET requests is a classic example of this weakness. Furthermore, in the context of the MITRE ATT&CK framework, this behavior relates to techniques involving social engineering and browser-based attacks where an attacker leverages trusted relationships with systems or users to execute malicious actions. The specific path involved includes the file admin/inc/functions_view_manager.php, which handles the logic for updating view preferences but omits critical security controls necessary to verify that the request originated from a legitimate source within the application context.
To mitigate this vulnerability and prevent similar issues in future development, it is essential to implement robust anti-CSRF protections across all state-changing operations. This includes generating unique, unpredictable tokens per session or user action and validating these tokens on every POST or GET request that modifies server-side state. Additionally, adhering to the principle of using HTTP methods correctly by restricting state modifications to non-idempotent methods like POST can reduce exposure. For administrators currently running versions prior to 1.8.40, immediate upgrading is strongly recommended as this issue has been resolved in version 1.8.40 and later releases. Regular security audits and adherence to secure coding standards are vital for maintaining the integrity of web applications that handle sensitive administrative functions.