CVE-2026-45126lowCWE-352

CVE-2026-45126: falha de baixa gravidade em mybb

MyBB: ACP Questions state CSRF

Publicada em

Seguir esta CVE+ Monitorar mybb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.5epss 0.2%
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
mybb · mybb
CVEs relacionadas — mybb

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24734HIGHRemote code execution in mybbEPSS 77.8%CVE-2022-39265HIGHMail settings' command parameter injection in mybbEPSS 3.1%CVE-2026-45117CRITICALMyBB: Installer database configuration RCEEPSS 1.1%CVE-2025-48940HIGHMyBB's upgrade component vulnerable to local file inclusionEPSS 0.6%CVE-2024-23335MEDIUMBackups directory .htaccess deletion in. MyBBEPSS 0.6%CVE-2026-45734MEDIUMMyBB: Default CAPTCHA missing invalidationEPSS 0.6%