Description

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-18T16:17:06.773Z",
  "pubdate": "2026-08-18T16:17:06.773Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability leading to Denial of Service (DoS) exists in MyBB prior to version 1.8.40.\nThe vulnerability resides in the Admin CP UTF-8 Conversion module, specifically within the system health administration tool.\nSame-site attackers can exploit this flaw by tricking an authenticated administrator into accessing a specially crafted URL, triggering unauthorized database table alterations.\nThe exploitation results in unwanted table encoding modifications, column rewrites, and fulltext index rebuilds, effectively causing a denial of service.\nThe impact includes database corruption, performance degradation, and operational disruption of the forum software.\nAttack capabilities are restricted to same-site attackers who can leverage social engineering or malicious web content to induce the victim into making the unintended GET request.\nSuccessful exploitation requires the target administrator to have an active administrative session in the Admin CP while interacting with the attacker-controlled resource.",
  "technicalDetails": "The root cause of the vulnerability is the lack of request verification, such as anti-CSRF tokens, within the Admin CP UTF-8 Conversion module of MyBB.\nThe vulnerable component is located in admin/modules/tools/system_health.php.\nSpecifically, the do=all control flow processes operations via HTTP GET requests without validating the origin or intent of the request.\nThe module accepts a table parameter specifying the target database table and performs intensive database operations, including ALTER TABLE statements, column rewrite phases, and fulltext index rebuilds.\nAffected versions include all MyBB releases prior to 1.8.40.\nAuthentication and privilege requirements dictate that the target must be an authenticated administrator with access to the Admin CP.\nNetwork exposure is constrained to the web application context where the administrative control panel is hosted.\nThe attack flow proceeds as follows: 1) An attacker identifies or crafts a malicious URL targeting the admin/modules/tools/system_health.php script with the do=all parameter and a specific table parameter. 2) The attacker induces an authenticated administrator to visit this URL via a cross-site context, such as an embedded image link or a malicious redirect. 3) The browser automatically includes the administrative session cookies in the GET request. 4) The application processes the GET request without verifying request authenticity. 5) The server executes destructive database operations including ALTER TABLE, column rewrites, and fulltext index rebuilds on the targeted table. 6) The resulting state alters table encodings and disrupts database integrity, leading to a denial of service.\nPost-exploitation impact involves application instability, broken database schemas, data access failures, and complete service unavailability for the MyBB forum."
}