CVE-2026-47245 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account's first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open-source forum software that facilitates community interactions through threaded discussions, user profiles, and administrative controls. Within this ecosystem, the User Control Panel serves as a critical interface for end-users to manage their personal settings, including social connections such as buddy lists and ignore lists. These features allow users to curate who they interact with or block from communicating with them. The integrity of these reciprocal relationship updates is essential for maintaining accurate user state data within the application database. Prior to version 1.8.40, a significant logic flaw existed in the handling of buddy list modifications, specifically within the component responsible for processing deletions from these lists via the User Control Panel interface.
The technical vulnerability resides in the backend handler located at mybb.php with the action parameter set to do_editlists and an operation type indicating deletion. When a user initiates the removal of another user from their buddy or ignore list, the system is designed to perform two distinct database operations: first, removing the entry from the acting user's personal list stored in memory or session data, and second, updating the mybb_users table to reflect this change for the target account. The intended behavior requires that if User A removes User B from their buddy list, User B should also have User A removed from their own buddy list to maintain reciprocity. However, the implementation contains a critical logical error where the script searches for the wrong identifier during this reciprocal update process. Instead of searching for the UID of the acting user who initiated the deletion, the code incorrectly searches for the UID of the target account being deleted.
This flaw exploits how PHP handles array search operations when an element is not found. The function array_search() returns false if the specified value does not exist in the array. In this vulnerable version, the return value from this unchecked operation was used directly as an index key to unset or modify elements within a buddy list array. Due to PHP's type juggling rules, the boolean value false is coerced into the integer 0 when used as an array index. Consequently, if the acting user does not appear in the target account's current buddy list—which can occur due to timing issues, prior deletions by the other party, or simply because they were never mutual buddies—the search fails and returns false. This false value becomes index 0, causing the system to remove the first entry stored in the target account's buddy list array rather than attempting a non-existent reciprocal removal of the acting user.
The operational impact of this vulnerability is twofold. First, it results in data integrity issues where the intended reciprocal update fails silently or incorrectly, leaving stale references in the database that do not reflect actual user interactions. More critically, because index 0 corresponds to the first element in the array structure used for storage, any buddy entry at position zero belonging to the target account is erroneously deleted. This means a random third party who happens to be listed as the first friend of the targeted user will have their connection severed without consent or knowledge. This constitutes an unauthorized modification of data and can lead to confusion among users regarding their social connections within the forum environment. From a security perspective, this represents a logic flaw that allows for unintended state changes affecting multiple unrelated entities based on the arbitrary ordering of stored buddy IDs.
This vulnerability aligns with CWE-602, Client-Side Enforcement of Server-Side Security, although in this context it is more accurately described as CWE-841: Improper Enforcement of Behavioral Constraints or CWE-937: Use of OWASP Top Ten Vulnerable Libraries if considered through the lens of flawed logic implementation. In terms of attack vectors and techniques, this behavior maps to MITRE ATT&CK technique T1059.006, Command Scripting, specifically involving improper input validation leading to unintended side effects, or more broadly under data manipulation tactics where an attacker can influence system state by exploiting weak assumptions about array indices and type coercion. While the primary impact is integrity-related rather than confidentiality or availability, it demonstrates how poor handling of return values from search functions can lead to destructive outcomes in application logic.
Mitigation for this issue requires upgrading MyBB to version 1.8.40 or later, where the developers have corrected the reciprocal update logic to properly validate the existence of the acting user within the target's buddy list before attempting removal. For organizations unable to immediately patch, administrative oversight is recommended to monitor buddy lists for unexpected deletions. Developers should ensure that all array search operations check for false returns explicitly and handle them appropriately rather than relying on implicit type conversion. Validating indices against actual data presence prevents the coercion of boolean failures into valid integer keys, thereby preserving the integrity of relational data structures within the application database.