CVE-2026-47245: MyBB Auth Bypass Vulnerability

CVE-2026-47245 Overview

CVE-2026-47245 affects MyBB, an open source forum software package. The vulnerability resides in the User CP Buddy/Ignore List component, which fails to validate reciprocal buddy-list updates correctly. When a user deletes a buddy entry through usercp.php?action=do_editlists, the reciprocal update searches for the wrong user ID and passes an unchecked array_search() return value as an array key. A false result silently converts to index 0, corrupting the target account's buddy list by removing an unrelated entry. The issue is fixed in MyBB version 1.8.40.

Critical Impact
Authenticated attackers can corrupt other users' buddy lists by triggering a reciprocal delete against an arbitrary target UID, causing integrity loss without any interaction from the victim.

Affected Products

MyBB forum software prior to version 1.8.40
Deployments exposing the User CP buddy/ignore list feature
Any MyBB instance permitting authenticated user accounts

Discovery Timeline

2026-08-18 - CVE-2026-47245 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-47245

Vulnerability Analysis

The flaw is an unchecked return value issue [CWE-252] in MyBB's usercp.php delete handler. When an authenticated user removes an entry from their buddy list, the handler correctly deletes the target from the acting user's list. It then attempts to update mybb_users.buddylist for the target account to keep both sides consistent.

The reciprocal update calls array_search() on the target user's stored buddy list, but supplies the deleted target UID instead of the acting user's UID. When the value is not found, array_search() returns false. PHP then coerces false to integer 0 when used as an array key.

As a result, the code removes whichever entry sits at index 0 of the target's buddy list. The actual reciprocal entry, referencing the acting user, remains intact. The vulnerability enables authenticated attackers to alter other users' buddy lists without their consent, breaking data integrity for the buddy relationship feature.

Root Cause

The root cause is two combined defects: an incorrect search key passed to array_search(), and no verification of a false return before using it as an array offset. PHP's loose type conversion turns the sentinel value into a valid index, silently corrupting adjacent data.

Attack Vector

Exploitation requires an authenticated account and a network-accessible MyBB instance. The attacker issues a crafted usercp.php?action=do_editlists request with delete set to an arbitrary target user ID. No interaction from the target is needed.

php

 		{
 			unset($existing_users[$key]);
 			$user = get_user($mybb->get_input('delete', MyBB::INPUT_INT));
-			if(!empty($user))
+			if(!empty($user) && $mybb->get_input('manage') == "buddy")
 			{
 				// We want to remove us from this user's buddy list
 				if($user['buddylist'] != '')

Source: GitHub Commit 0557718. The patch restricts the reciprocal update path so it only executes when the manage action equals buddy, preventing the corrupted code path from running under the ignore-list flow.

Detection Methods for CVE-2026-47245

Indicators of Compromise

Unexpected changes to entries in the mybb_users.buddylist column for accounts that did not initiate the change.
HTTP POST requests to usercp.php?action=do_editlists containing a delete parameter targeting arbitrary user IDs.
User complaints or support tickets reporting missing buddies without corresponding user activity.

Detection Strategies

Review web server access logs for repeated do_editlists requests from a single authenticated session against many target UIDs.
Compare current buddylist values against database backups to identify unexplained removals.
Monitor MyBB error and audit logs for anomalies around the User CP buddy management endpoint.

Monitoring Recommendations

Enable request logging on the User CP endpoints and alert on high-frequency do_editlists calls per account.
Track baseline buddy-list change rates per user and flag statistical outliers.
Retain database change logs long enough to correlate corruption reports with source requests.

How to Mitigate CVE-2026-47245

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which contains the official fix.
Audit administrator and moderator accounts for unusual buddy-list activity following upgrade.
Restrict buddy-list feature access to trusted user groups until patching is complete.

Patch Information

The fix is delivered in the MyBB 1.8.40 release and documented in the GitHub Security Advisory GHSA-w8gm-j57p-jqpc. The corresponding code change appears in commit 0557718. Release notes are available on the MyBB 1.8.40 versions page.

Workarounds

Temporarily disable the buddy/ignore list feature for user groups through the Admin CP where feasible.
Apply the upstream patch manually to usercp.php if a full upgrade cannot be scheduled immediately.
Take a fresh database backup before upgrading so any corrupted buddy-list data can be reconciled post-patch.

bash

# Verify the installed MyBB version after upgrade
grep -R "MYBB_VERSION" /var/www/mybb/inc/init.php