CVE-2026-45128: MyBB Forum Software CSRF Vulnerability

CVE-2026-45128 Overview

CVE-2026-45128 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in MyBB, a widely deployed open source forum software. The flaw resides in the Admin Control Panel (ACP) Users View Manager module. The set_default control in Admin CP → Users & Groups → Users → View Manager processes GET requests without any request forgery protection. A same-site attacker can craft a URL that, once loaded by a victim administrator, silently changes that administrator's default user list view. The issue affects all MyBB releases prior to 1.8.40 and is resolved in version 1.8.40.

Critical Impact
Same-site attackers can alter an authenticated administrator's default user list view by tricking them into loading a crafted URL, resulting in low-integrity impact on the ACP.

Affected Products

MyBB forum software versions prior to 1.8.40
Admin Control Panel module admin/inc/functions_view_manager.php
ACP path: Users & Groups → Users → View Manager

Discovery Timeline

2026-08-18 - CVE CVE-2026-45128 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45128

Vulnerability Analysis

The vulnerability is a classic CSRF flaw in the ACP Users View Manager. The set_default action mutates administrator state (which saved view becomes the default) but is invoked over HTTP GET without validating a per-session anti-CSRF token. Because the state change is triggered by an idempotent-looking GET, any embedded resource such as an image tag, iframe, or hyperlink on a same-site page can drive the request using the administrator's active session cookies. The impact is limited to changing the default view row in the adminviews table, which is why the CVSS vector reflects low integrity impact and no confidentiality or availability impact.

Root Cause

The root cause is missing request forgery protection in the set_default branch of admin/inc/functions_view_manager.php. The code path accepted the vid parameter and updated the administrator's default view without calling verify_post_check() to validate the my_post_key token. State-changing operations should be constrained to POST and require a token that is unpredictable to attackers.

Attack Vector

An attacker with the ability to place content on a same-site origin, or to lure an authenticated administrator to a crafted page, embeds a URL that targets the vulnerable set_default endpoint with an attacker-chosen vid. When the administrator visits the page while authenticated to the ACP, their browser issues the request and the default view is overwritten. User interaction is required, and the attacker must have low privileges on the target site.

php

// Security patch in admin/inc/functions_view_manager.php
// Fix ACP Users View Manager default CSRF (CVE-2026-45128)

	if($mybb->input['do'] == "set_default")
	{
+		if(!verify_post_check($mybb->get_input('my_post_key')))
+		{
+			flash_message($lang->invalid_post_verify_key2, 'error');
+			admin_redirect($base_url."&action=views");
+		}
+
 		$query = $db->simple_select("adminviews", "vid, uid, visibility", "vid='".$mybb->get_input('vid', MyBB::INPUT_INT)."'");
 		$admin_view = $db->fetch_array($query);

Source: GitHub commit 736a2bcb. The patch adds a call to verify_post_check() against the my_post_key token and aborts with an error flash message on mismatch.

Detection Methods for CVE-2026-45128

Indicators of Compromise

Unexpected changes to the default admin view row in the adminviews table where visibility corresponds to an administrator account.
ACP access log entries showing action=views with do=set_default and a vid parameter that the administrator did not intentionally trigger.
HTTP Referer headers on set_default requests originating from same-site pages controlled by low-privilege users.

Detection Strategies

Inspect web server access logs for GET requests to the admin index containing both do=set_default and a vid parameter, correlated with an admin session cookie.
Compare recent adminviews state changes against admin activity records to identify view modifications with no matching intentional UI interaction.
Alert on ACP state-changing requests that arrive without a my_post_key value on pre-1.8.40 installations.

Monitoring Recommendations

Enable and retain MyBB Admin Log entries and forward them to a centralized logging platform for review.
Monitor for cross-origin or same-site referers on ACP endpoints and flag any that touch administrative configuration paths.
Track deployed MyBB versions across hosted forums and alert on any instance still reporting a version earlier than 1.8.40.

How to Mitigate CVE-2026-45128

Immediate Actions Required

Upgrade MyBB to version 1.8.40, which contains the CSRF fix in admin/inc/functions_view_manager.php.
Terminate active administrator sessions after upgrade and require re-authentication to invalidate any pre-existing session artifacts.
Review the adminviews table for unexpected default view assignments and restore correct values where needed.

Patch Information

The fix is included in MyBB 1.8.40. Reference the MyBB 1.8.40 release notes, the GitHub release tag mybb_1840, and the GitHub Security Advisory GHSA-m6hr-25cj-p58q. The patch adds a verify_post_check($mybb->get_input('my_post_key')) guard on the set_default action and redirects with an error flash message when the token is invalid.

Workarounds

Restrict ACP access by IP allow-list at the web server or reverse proxy layer until the upgrade is applied.
Advise administrators to use a dedicated browser or profile for ACP sessions and to log out immediately after administrative work.
Deploy a web application firewall rule that blocks GET requests to the admin index containing do=set_default on installations still running versions prior to 1.8.40.

bash

# Example WAF-style rule for reverse proxy (illustrative)
# Block set_default via GET on the MyBB admin endpoint pre-1.8.40
location /admin/index.php {
    if ($request_method = GET) {
        if ($arg_do = "set_default") {
            return 403;
        }
    }
}