MyBB CVE-2026-45126

Exploitation requires three concurrent conditions: (1) the attacker must be a same-site actor - either a registered forum user or someone able to cause the admin's browser to issue a request from the same web origin; (2) an administrator must be authenticated to the MyBB Admin CP in the same browser session and must be induced to follow the crafted URL (UI:R); and (3) the target MyBB installation must be running a version prior to 1.8.40 with the Security Questions module present. Exploitation is limited to toggling the mybb_questions.active field - no data exfiltration, remote code execution, or privilege escalation is achievable through this vulnerability alone. Modern browser SameSite cookie policies (Lax or Strict) applied to the Admin CP session cookie would block cross-site delivery of the GET request, though same-site delivery (e.g., via forum post on the same domain) remains viable.

The CVSS 3.1 base score of 3.5 (Low) accurately reflects the constrained real-world risk: the only achievable outcome is toggling the active status of registration bot-protection challenge questions, with no confidentiality or availability impact. The description explicitly restricts the attack surface to same-site attackers, meaning the threat actor must already have a presence on the same MyBB installation or the same web origin - a materially higher bar than the AV:N vector alone suggests. The UI:R requirement compounds this: a logged-in administrator must be socially engineered into visiting the crafted URL during an active session. No EPSS score was provided in the input data; the vulnerability is absent from the CISA KEV catalog; and no independent proof-of-concept exploit has been identified. The practical risk to most operators is low - the worst achievable outcome is silently disabling a spam-prevention feature, which is recoverable with a single admin action. The CVSS vector's PR:L reflects the attacker's need for a forum-level account to conduct a plausible same-site attack. CVSS and description signals are consistent and not conflicting.

An attacker with a low-privilege forum account embeds a crafted URL such as index.php?module=config-questions&action=disable in forum content or a private message, then waits for an authenticated administrator to click it while logged into the Admin CP. The browser sends the GET request with the administrator's session cookie, the controller processes the disable action without token validation, and registration challenge questions are silently disabled - removing bot-protection from new account registrations without the administrator's awareness.