Description

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass Mail, Mass Mailing Archive duplicates archived mailing entries into new drafts with mybb_massemails.status set to 0 on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Mass Mail → Mass Mailing Archive, mybb_massemails.status = 0, and admin/modules/user/mass_mail.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-18T16:17:07.947Z",
  "pubdate": "2026-08-18T16:17:07.947Z",
  "executiveSummary": "An unauthenticated request forgery vulnerability exists within the Admin Control Panel (ACP) Mass Mail module of MyBB prior to version 1.8.40. The vulnerability resides in the Mass Mailing Archive Resend route, which fails to properly validate incoming requests or implement anti-CSRF protection mechanisms.\nA same-site attacker can exploit this flaw by embedding a specially crafted URL designed to trick an authenticated administrator into executing unauthorized actions via a standard HTTP GET request.\nSuccessful exploitation allows an attacker to manipulate the application state by duplicating archived mass mailing entries into new drafts, setting the database field mybb_massemails.status to 0.\nThis vulnerability impacts the integrity of administrative communications and administrative workflows within MyBB installations running versions prior to 1.8.40.\nMitigation requires updating the MyBB software to version 1.8.40 or later, where proper request validation and forgery protection measures are implemented within the affected module.",
  "technicalDetails": "The vulnerability is localized within the Admin CP Mass Mail module of MyBB, specifically in the file admin/modules/user/mass_mail.php under the Users & Groups, Mass Mail, Mass Mailing Archive interface.\nThe root cause stems from insufficient request validation and the complete absence of request forgery protection on the Resend administrative route. The application processes state-changing operations via standard HTTP GET requests rather than restricted methods like POST accompanied by unpredictable cryptographic tokens.\nThe vulnerable component handles the duplication of archived mailing entries into new draft entries. When an authenticated administrator accesses a crafted URL targeting this route, the application processes the instruction without verifying user intent.\nUpon processing the malicious GET request, the backend logic duplicates an archived mailing entry into a new draft within the database, explicitly modifying the mybb_massemails.status parameter to 0.\nThe attack flow requires a same-site attacker to induce an authenticated administrator with access to the Admin Control Panel to load the specially crafted URL, typically via malicious cross-site content or embedded resources.\nBecause the affected route relies solely on session authentication inherent to the administrative browser context without enforcing anti-CSRF tokens, the browser automatically attaches the necessary session cookies to the forged request.\nThe exploitation vector requires administrative privileges, specific same-site attacker positioning or user interaction, and network exposure to the administrative control panel of the targeted MyBB instance.\nThe post-exploitation impact is limited to unauthorized state modification within the mass mailing system, specifically the generation of unintended draft entries from archived records, thereby corrupting administrative data integrity."
}