MyBB EUVD-2026-61014

Exploitation requires the target MyBB instance to have the built-in MyBB Default CAPTCHA enabled via the captchaimage configuration setting; instances using third-party CAPTCHA providers or with CAPTCHA disabled are not affected. The attacker must be unauthenticated - the commit confirms that contact.php and sendthread.php fixes are explicitly gated on $mybb->user['uid'] == 0, meaning logged-in users cannot reach these vulnerable paths. For member.php actions (do_resendactivation, do_lostpw, do_emailuser), the fix is gated only on captchaimage, consistent with those endpoints being publicly accessible to guests by design. No special network position, elevated privilege, or non-default server configuration beyond captchaimage being active is required. Exploitation is bounded to CAPTCHA bypass and form-submission automation - it does not provide a path to code execution, authentication bypass, or data access.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the low-complexity, unauthenticated network exploitation path and the limited integrity-only impact. The absence of a CISA KEV listing and no identified POC indicate this has not been observed in active exploitation campaigns at time of analysis. The real-world risk is narrowly scoped: an attacker can automate form submissions on CAPTCHA-protected endpoints - enabling spam, password-reset flooding, or contact-form abuse - but cannot leverage this flaw for code execution, credential theft, or privilege escalation. Forums relying solely on MyBB's built-in CAPTCHA as their primary anti-automation barrier will see that control neutralized. EPSS data was not provided in the input, so exploitation probability cannot be quantified beyond what the CVSS vector implies. Overall, this is a genuine medium-priority issue for exposed MyBB instances with captchaimage enabled, but not a critical emergency for most operators.

An attacker visits a vulnerable MyBB forum's lost-password page, solves the CAPTCHA challenge once, and captures the validated session token. They then replay that token in automated HTTP requests to the do_lostpw, do_resendactivation, and contact.php endpoints in rapid succession, flooding victims' inboxes with password-reset or activation emails or spamming the site's contact form - all without solving any additional CAPTCHAs. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling.