Description

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users & Groups, Users, View Manager changes the administrator's default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-18T16:17:08.087Z",
  "pubdate": "2026-08-18T16:17:08.087Z",
  "executiveSummary": "MyBB prior to version 1.8.40 suffers from a Cross-Site Request Forgery (CSRF) vulnerability residing within the Admin CP Users View Manager module. The flaw allows same-site attackers to manipulate an authenticated administrator's default user list view configuration by forcing the browser to execute a specially crafted HTTP GET request.\nThe vulnerability specifically impacts the Set as Default control mechanism handled by the set_default parameter within the Users & Groups, Users, View Manager interface. The primary risk implication is unauthorized state modification within the administrative control panel without requiring multi-factor validation, anti-CSRF tokens, or cryptographic request verification.\nAn attacker possessing same-site access can exploit this weakness by embedding a malicious URL or payload within external resources, forcing the targeted administrator to execute unintended actions while authenticated. Although the impact is constrained to modifying UI views and administrative preferences rather than immediate remote code execution, it represents a breach of administrative integrity and can facilitate further social engineering or administrative confusion attacks.\nExploitation requires the victim administrator to have an active session in the Admin CP and interact with an attacker-controlled context or malicious payload embedded via the same site. The issue is resolved entirely in MyBB version 1.8.40 through proper implementation of request validation and state-changing request protections.",
  "technicalDetails": "The root cause of the vulnerability is the absence of robust request validation and lack of Cross-Site Request Forgery (CSRF) protection mechanisms, such as anti-CSRF tokens or cryptographically secure nonces, on state-changing operations within the Admin CP. Specifically, the application processes administrative modifications via insecure HTTP GET requests rather than restricted HTTP POST requests accompanied by token verification.\nThe vulnerable component is the ACP Users View Manager module, specifically localized within the admin/inc/functions_view_manager.php file and the corresponding interface located under Users & Groups, Users, View Manager. The functionality exposes the set_default control parameter, which immediately updates the administrator's default user list view preferences upon receiving a direct GET request.\nThe attack flow proceeds as follows: 1) An attacker identifies or crafts a malicious URL targeting the vulnerable administrative endpoint that invokes the set_default action with specific parameters. 2) The attacker embeds this crafted URL into an external resource, image tag, iframe, or hyperlink accessed via a same-site context by an authenticated administrator. 3) The victim administrator's browser automatically issues an HTTP GET request to the MyBB Admin CP endpoint while automatically attaching valid administrative session cookies. 4) The server processes the request without validating whether the action originated from an intentional user interaction within the legitimate administrative interface. 5) The administrative user's default user list view configuration is silently altered to the attacker's specification.\nAuthentication and privilege requirements dictate that the target must be an authenticated administrator with active access to the Admin CP. The network exposure is restricted to the web application context where the administrative panel is hosted. The payload behavior relies on inducing state change through standard browser request handling. Post-exploitation impact centers on unauthorized modification of administrative view states, potentially disrupting workflow visibility or laying groundwork for subsequent targeted administrative attacks."
}