CVE-2026-45119: MyBB Admin CP UTF-8 DoS Vulnerability

CVE-2026-45119 Overview

CVE-2026-45119 is a Cross-Site Request Forgery [CWE-352] vulnerability in MyBB, an open source forum software package. The flaw affects the Admin Control Panel (ACP) UTF-8 Conversion module in versions prior to 1.8.40. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests without verifying request authenticity. Same-site attackers can craft a URL that, when visited by an authenticated administrator, alters table encoding and denies service. MyBB fixed the issue in version 1.8.40 by requiring a post verification key.

Critical Impact
An authenticated administrator visiting a crafted link can trigger destructive schema operations, leading to service disruption on the targeted MyBB forum.

Affected Products

MyBB forum software versions prior to 1.8.40
admin/modules/tools/system_health.php UTF-8 Conversion module
MyBB deployments allowing administrator ACP access

Discovery Timeline

2026-08-18 - CVE-2026-45119 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-45119

Vulnerability Analysis

The vulnerability resides in the UTF-8 Conversion routine within admin/modules/tools/system_health.php. The module executes destructive database operations when it receives either a POST request or a GET request containing do=all and a non-empty table parameter. Because the GET path does not verify a request token, an attacker can craft an authenticated URL that triggers ALTER TABLE, column rewrite, and fulltext index rebuild operations. When a logged-in administrator loads the malicious URL from a same-site context, the server performs the schema changes against the specified table.

Root Cause

The root cause is missing anti-CSRF verification on a state-changing endpoint [CWE-352]. The original control flow accepted do=all via GET without calling verify_post_check() against the my_post_key token. State-changing operations must never be reachable through unverified GET requests.

Attack Vector

Exploitation requires an authenticated administrator to interact with attacker-controlled content in a same-site context. The attacker crafts a URL targeting admin/index.php?module=tools-system_health&action=utf8_conversion&do=all&table=<name> and lures the administrator to load it. The server then applies alterations to the specified table, potentially degrading availability and integrity of forum data.

php

// Security patch in admin/modules/tools/system_health.php
// Fix ACP UTF-8 Conversion CSRF (CVE-2026-45119)

if($mybb->request_method == "post" || ($mybb->input['do'] == "all" && !empty($mybb->input['table'])))
{
    if(!verify_post_check($mybb->get_input('my_post_key')))
    {
        flash_message($lang->invalid_post_verify_key2, 'error');
        admin_redirect("index.php?module=tools-system_health&action=utf8_conversion");
    }

    if(!empty($mybb->input['mb4']) && version_compare($db->get_version(), '5.5.3', '<'))
    {
        flash_message($lang->error_utf8mb4_version, 'error');

Source: GitHub Commit 70d445d. The patch adds a verify_post_check() call against my_post_key before any schema-modifying logic runs.

Detection Methods for CVE-2026-45119

Indicators of Compromise

Unexpected ALTER TABLE statements in MySQL query logs targeting MyBB tables outside of scheduled maintenance windows.
Web server access log entries containing module=tools-system_health, action=utf8_conversion, and do=all on GET requests.
MyBB admin logs recording UTF-8 conversion events that administrators did not initiate.

Detection Strategies

Monitor Referer headers for ACP requests originating from external or unexpected same-site domains.
Correlate administrator session activity with schema-changing SQL operations to identify unauthorized triggers.
Alert on GET requests to admin endpoints that carry parameters normally submitted via POST forms.

Monitoring Recommendations

Enable MySQL general or audit logging for the MyBB database and forward records to a central log store.
Track MyBB adminlog entries for tools/system_health actions and review them for unusual sources.
Watch for HTTP 302 redirects to index.php?module=tools-system_health&action=utf8_conversion following the patch, which indicate blocked CSRF attempts.

How to Mitigate CVE-2026-45119

Immediate Actions Required

Upgrade MyBB installations to version 1.8.40 or later, which introduces the verify_post_check() guard on the UTF-8 Conversion endpoint.
Audit administrator accounts and rotate credentials if unexpected schema changes appear in database logs.
Restrict ACP access to trusted IP ranges through web server or firewall rules.

Patch Information

MyBB addressed the vulnerability in the MyBB 1.8.40 release. The specific fix is documented in the GitHub Security Advisory GHSA-p48q-4vgf-q7x8 and the patch commit 70d445d. Additional release information is available on the MyBB 1.8.40 version page.

Workarounds

Temporarily block GET requests to admin/index.php that include the do=all and table parameters at the web application firewall.
Require administrators to authenticate through a separate browser profile that does not visit untrusted content.
Disable direct internet exposure of the MyBB ACP until the patch is applied.

bash

# Example nginx rule to block the vulnerable GET pattern until patched
location = /admin/index.php {
    if ($request_method = GET) {
        if ($arg_module = "tools-system_health") {
            if ($arg_do = "all") { return 403; }
        }
    }
}