Description

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-18T16:17:07.803Z",
  "pubdate": "2026-08-18T16:17:07.803Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in MyBB prior to version 1.8.40 within the Admin CP Security Questions module.\nThe vulnerability allows same-site attackers to enable or disable registration challenge questions by exploiting missing anti-CSRF token validation.\nThe affected product is MyBB forum software versions prior to 1.8.40.\nThe risk implication is unauthorized state modification of administrative security configurations without explicit administrator consent.\nAttacker capabilities include tricking an authenticated administrator into executing unintended administrative actions via a specially crafted URL.\nExploitation requires the victim administrator to interact with a malicious or untrusted same-site resource while authenticated to the Admin CP.",
  "technicalDetails": "The root cause of the vulnerability is the improper validation of anti-CSRF tokens within the Admin CP Security Questions module. Specifically, the controller processes HTTP GET requests for the disable and enable actions to modify the mybb_questions.active database field.\nThe application fails to verify the my_post_key anti-CSRF token that is normally attached by the user interface to validate state-changing requests.\nThe vulnerable component is located in admin/modules/config/questions.php.\nAffected versions include all MyBB releases prior to version 1.8.40.\nAuthentication and privilege requirements dictate that the target must be an authenticated administrator interacting with the Admin CP.\nThe attack flow proceeds when an attacker constructs a specially crafted URL targeting the enable or disable actions within the vulnerable module. When an authenticated administrator visits this URL or loads an embedded resource pointing to it, the browser automatically includes relevant session cookies.\nThe backend controller processes the incoming GET request and updates mybb_questions.active directly without checking for a valid my_post_key parameter.\nThe payload behavior involves forcing unintended state changes to registration challenge questions, potentially weakening or disrupting the forum's anti-bot security mechanisms.\nThe post-exploitation impact includes unauthorized alteration of administrative security configurations, leading to potential denial of service for registration challenges or enablement of unvetted questions."
}