CVE-2026-45127: MyBB ACP Mass Mail CSRF Vulnerability

CVE-2026-45127 Overview

CVE-2026-45127 is a Cross-Site Request Forgery [CWE-352] vulnerability in MyBB, an open source forum software. The flaw resides in the Admin Control Panel (ACP) Mass Mail module. Prior to version 1.8.40, the Resend route in Users & Groups → Mass Mail → Mass Mailing Archive fails to validate anti-forgery tokens on GET requests. A same-site attacker can embed a crafted URL to trigger duplication of archived mailing entries into new drafts with mybb_massemails.status = 0. The vulnerable logic lives in admin/modules/user/mass_mail.php. MyBB fixed the issue in version 1.8.40.

Critical Impact
An authenticated administrator visiting an attacker-controlled page can be forced to create unauthorized draft mass mail entries without their consent.

Affected Products

MyBB forum software versions prior to 1.8.40
ACP Mass Mail module (admin/modules/user/mass_mail.php)
Mass Mailing Archive Resend route

Discovery Timeline

2026-08-18 - CVE-2026-45127 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-45127

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the MyBB Admin Control Panel. The Resend action within the Mass Mailing Archive processes state-changing operations without validating a request forgery token. When an authenticated administrator loads a URL containing action=resend and a valid mid parameter, MyBB duplicates the referenced archived mailing entry into a new draft. The new record is inserted with mybb_massemails.status = 0, marking it as a draft. Because the request is a simple GET, an attacker can embed the URL in an image tag, iframe, or link on any same-site page reachable by the administrator to trigger unwanted draft creation.

Root Cause

The root cause is missing anti-CSRF token verification on a state-changing GET handler. The resend branch in admin/modules/user/mass_mail.php performed a database simple_select and subsequent insert without first calling verify_post_check() against a my_post_key value. This omission violates the principle that any request causing server-side state changes must be authenticated with an unpredictable, per-session token.

Attack Vector

Exploitation requires an authenticated MyBB administrator with access to the Mass Mail module to visit or render an attacker-controlled resource containing the crafted URL. User interaction is required, and the attacker needs low privileges on a same-site context. The confidentiality impact is none, and the integrity impact is limited to creating draft mailing entries. No emails are actually sent as a direct result of the exploit.

php

// Security patch in admin/modules/user/mass_mail.php
if($mybb->input['action'] == "resend")
{
+	if(!verify_post_check($mybb->get_input('my_post_key')))
+	{
+		flash_message($lang->invalid_post_verify_key2, 'error');
+		admin_redirect("index.php?module=user-mass_mail&action=archive");
+	}
+
 	// Copy and resend an email
 	$query = $db->simple_select("massemails", "*", "mid='".$mybb->get_input('mid', MyBB::INPUT_INT)."'");
 	$mass_email = $db->fetch_array($query);

Source: GitHub Commit a95c5d6 — the patch adds a verify_post_check() call so the resend action rejects requests lacking a valid post verification key.

Detection Methods for CVE-2026-45127

Indicators of Compromise

Unexpected rows in the mybb_massemails table with status = 0 that administrators do not recognize creating.
Web server access logs containing GET requests to index.php?module=user-mass_mail&action=resend&mid=<id> originating from external referrers.
Administrator session activity immediately following a click or page load on an untrusted external site.

Detection Strategies

Audit the mybb_massemails table for draft entries whose creation timestamps do not correlate with legitimate admin session activity.
Alert on ACP requests that include the action=resend parameter but lack a valid my_post_key value in the query.
Correlate HTTP Referer headers on ACP endpoints against an allowlist of trusted administrative origins.

Monitoring Recommendations

Enable verbose logging on the admin/modules/user/mass_mail.php endpoint to capture request method, parameters, and referrer.
Monitor for anomalous GET-based state changes across all ACP modules, not only Mass Mail.
Review MyBB admin audit logs regularly for unexplained draft creation events.

How to Mitigate CVE-2026-45127

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which introduces the missing verify_post_check() call on the resend action.
Review the mybb_massemails table and delete unauthorized draft entries created before patching.
Instruct administrators to log out of the ACP when not actively performing administrative tasks.

Patch Information

MyBB released version 1.8.40 with the fix. The relevant commit is a95c5d6. See the MyBB 1.8.40 Release Notes, the GHSA-xx78-g79m-qvgq Security Advisory, and the MyBB 1.8.40 Version Page for additional detail.

Workarounds

Restrict ACP access to specific IP ranges via web server or firewall rules until the patch is applied.
Require administrators to use a dedicated browser or profile for MyBB administration to limit same-site attack surface.
Apply the upstream patch manually to admin/modules/user/mass_mail.php in environments that cannot immediately upgrade.

bash

# Verify installed MyBB version and upgrade path
grep -R "MYBB_VERSION" ./inc/class_core.php
# Backup database before upgrade
mysqldump -u <user> -p <db_name> > mybb_backup.sql
# Apply MyBB 1.8.40 upgrade following official upgrade instructions