CVE-2026-45126: MyBB: ACP Questions state CSRF
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybbquestions.active without verifying the mypostkey token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBB (Admin CP Security Questions module)to a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which deployments are affected?
MyBB installations running versions before 1.8.40 are affected, specifically the Admin CP Security Questions module. The issue was fixed in MyBB 1.8.40.
What does an attacker need to exploit this?
An attacker needs a logged-in administrator to interact with a specially crafted URL. The vulnerable enable and disable actions are processed through GET requests without validating the anti-CSRF token.
What can an attacker change?
Successful exploitation can enable or disable registration challenge questions by changing the mybb_questions.active setting. The stated impact is limited to integrity; no confidentiality or availability impact is identified.