Description

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account's first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T16:17:09.507Z",
  "pubdate": "2026-08-18T16:17:09.507Z",
  "executiveSummary": "A logic vulnerability exists within the User CP Buddy/Ignore List component of MyBB prior to version 1.8.40, specifically related to the improper validation of reciprocal buddy-list updates during deletion operations.\nThe vulnerability allows an authenticated user to induce unintended data corruption within the mybb_users.buddylist database field of targeted accounts.\nThe root cause stems from unchecked return values of the array_search() function which are implicitly converted to array keys.\nAn attacker can exploit this flaw via the usercp.php?action=do_editlists endpoint by initiating a buddy deletion request.\nSuccessful exploitation results in the integrity violation of the target account's buddy list, specifically causing the removal of the user stored at index 0 while leaving the intended reciprocal entry unmodified.\nThe risk implications involve unauthorized modification of user profile data and unintended removal of connections within the forum platform.\nNo specific advanced attacker capabilities or privileges beyond standard user access are required, as any registered user can manage their own buddy and ignore lists.",
  "technicalDetails": "The vulnerability resides in the usercp.php script within MyBB, specifically handling the do_editlists action for the buddy list deletion functionality.\nWhen a user executes a buddy deletion request via usercp.php?action=do_editlists, the application processes the acting user's list by removing the selected entry and subsequently initiating a reciprocal update to synchronize the mybb_users.buddylist field for the target account.\nThe flaw occurs during the reciprocal update logic where the search routine queries the deleted target UID instead of the acting user's UID.\nFurthermore, the implementation utilizes the return value of array_search() directly as an array key without prior type checking or validation.\nWhen array_search() fails to find the expected entry, it returns boolean false, which is subsequently type-converted to the integer index 0 in a PHP array context.\nThis type conversion forces the application to target index 0 of the target account's buddy list array.\nConsequently, the exploitation flow causes the removal of the target account's first stored buddy instead of the actual reciprocal entry, while the legitimate reciprocal entry remains entirely unchanged.\nThe vulnerable component is the User CP Buddy/Ignore List module affecting MyBB versions prior to 1.8.40.\nAuthentication is required to access the User CP functionality, but no elevated privileges are necessary to trigger the flawed logic."
}