CVE-2026-45126: MyBB Admin CP CSRF Vulnerability

CVE-2026-45126 Overview

MyBB is free and open source forum software used by community sites worldwide. CVE-2026-45126 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the MyBB Admin Control Panel Security Questions module. Prior to version 1.8.40, the controller in admin/modules/config/questions.php processes GET requests for disable and enable actions without validating the my_post_key anti-CSRF token. Same-site attackers can craft a URL that toggles the mybb_questions.active state of registration challenge questions when an authenticated administrator visits it. The issue is fixed in MyBB 1.8.40.

Critical Impact
An authenticated administrator visiting a specially crafted URL can be tricked into enabling or disabling registration challenge questions, weakening bot protections on the forum.

Affected Products

MyBB forum software versions prior to 1.8.40
Admin CP Security Questions module (admin/modules/config/questions.php)
MyBB installations exposing the Admin Control Panel to authenticated administrators

Discovery Timeline

2026-08-18 - CVE-2026-45126 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45126

Vulnerability Analysis

The vulnerability affects the Security Questions administration module in MyBB. The module allows administrators to manage registration challenge questions stored in the mybb_questions table. State-changing actions in web applications must validate an anti-CSRF token to ensure the request originated from the legitimate user interface. In vulnerable MyBB versions, the disable and enable action handlers accept GET requests and modify the active column directly without calling verify_post_check() on the my_post_key parameter attached by the UI. An attacker who can lure an authenticated administrator to a malicious page can force the browser to issue a request that toggles question state. This weakens the registration challenge defense that MyBB uses to deter automated account creation.

Root Cause

The root cause is a missing anti-CSRF token validation in the disable and enable branches of admin/modules/config/questions.php. The controller reads the qid parameter and issues a database update without confirming the my_post_key value matches the session-bound token. State changes performed over GET compound the exposure because they can be triggered by image tags, iframes, or link previews.

Attack Vector

The attack requires an authenticated MyBB administrator to visit an attacker-controlled or same-site resource containing a crafted URL that targets the Admin CP questions endpoint with action=disable or action=enable and a valid qid. No credentials of the attacker are needed. The impact is limited to the integrity of the security questions configuration and does not directly expose confidential data.

php

// Security patch in admin/modules/config/questions.php
// Fix ACP Questions state CSRF (CVE-2026-45126)
if($mybb->input['action'] == "disable")
{
+	if(!verify_post_check($mybb->get_input('my_post_key')))
+	{
+		flash_message($lang->invalid_post_verify_key2, 'error');
+		admin_redirect("index.php?module=config-questions");
+	}
+
 	$query = $db->simple_select("questions", "*", "qid='".$mybb->get_input('qid', MyBB::INPUT_INT)."'");
 	$question = $db->fetch_array($query);

Source: GitHub Commit 6893b395. The patch inserts a verify_post_check() call that rejects the request and redirects with an error when the token is missing or invalid.

Detection Methods for CVE-2026-45126

Indicators of Compromise

Unexpected changes to the active column in the mybb_questions database table
Admin CP access log entries containing module=config-questions&action=disable or action=enable without a preceding form submission from the questions listing page
Referer headers on Admin CP question toggle requests pointing to external or unrelated origins

Detection Strategies

Review web server access logs for GET requests to the MyBB Admin CP config-questions module with disable or enable actions and cross-reference with administrator activity
Audit the mybb_questions table for state changes that do not correspond to legitimate administrator sessions
Compare the installed MyBB version against 1.8.40 to identify vulnerable deployments

Monitoring Recommendations

Alert on Admin CP requests that lack expected same-origin Referer values
Track database write operations against the mybb_questions.active field and correlate with authenticated admin sessions
Monitor for administrator browsing sessions that reach the Admin CP shortly after visiting untrusted external content

How to Mitigate CVE-2026-45126

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which adds the missing verify_post_check() call in the Security Questions module
Restrict Admin Control Panel access to trusted network ranges or via VPN to reduce cross-site attack surface
Instruct administrators to log out of the Admin CP when not actively managing the forum

Patch Information

The fix is available in MyBB 1.8.40 and documented in GHSA-m42q-vgx3-fqcc. The remediation commit is 6893b395c7fa3b9e4de6235caea0ce198c376c4f, which enforces the my_post_key check on disable and enable actions.

Workarounds

Place the /admin/ directory behind HTTP authentication or IP allowlisting until the upgrade is applied
Require administrators to use a dedicated browser profile with no third-party site access for Admin CP tasks
Temporarily disable the Security Questions feature if it is not required, reducing the value of a successful CSRF trigger

bash

# Example nginx configuration restricting Admin CP access by IP
location ^~ /admin/ {
    allow 192.0.2.0/24;
    deny all;
    try_files $uri $uri/ /admin/index.php?$args;
}