CVE-2026-45119: MyBB: ACP UTF-8 Conversion CSRF
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/systemhealth.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
MyBB installations prior to 1.8.40 are affected if an attacker can cause an authenticated Admin CP user to access a specially crafted same-site URL. The issue requires low privileges and user interaction, according to the supplied vector.
What does exploitation require and what can it do?
The vulnerable conversion workflow performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds through a GET request using the table parameter, without request verification. Successful exploitation can alter table encoding and cause denial of service.
What is the available remediation?
Upgrade MyBB to version 1.8.40, which fixes the issue. The provided information does not specify a workaround for installations that cannot yet be upgraded.