MyBB EUVD-2026-61050

Exploitation requires: (1) the attacker has same-site presence, meaning they can serve content - such as a forum post, private message, or profile signature - that the target administrator will load while authenticated in the MyBB Admin CP; (2) the victim administrator must actively click or otherwise trigger the crafted URL or embedded resource; (3) the administrator's ACP session cookie must be active at the time of the request. The vulnerable action is limited to the View Manager set_default endpoint within the Admin CP Users & Groups module. Exploitation does not affect unauthenticated users, non-admin accounts, or installations where administrators do not interact with forum user-generated content while their ACP session is open. The sole impact is silent modification of the administrator's default user list view preference - no privilege escalation, no credential exposure, no persistent code execution, and no data exfiltration.

The overall risk is low. The CVSS 3.1 base score of 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) accurately reflects a limited-impact vulnerability requiring both attacker same-site presence and active victim interaction; even a mid-sized municipal IT team in inowroclaw running a community forum would face minimal operational disruption, since the worst-case outcome is an administrator's default user list view preference being changed rather than any credential theft, data exfiltration, or service disruption. The vulnerability is not listed in CISA's KEV catalog, no public exploit code has been identified, and no EPSS data was provided in the source intelligence - all signals converge on low real-world priority. The 'same-site attacker' constraint is a meaningful limiting factor: the adversary must already possess a forum account or another means to serve content that the admin will encounter while authenticated in the ACP, ruling out fully unauthenticated remote exploitation. The CVSS network vector (AV:N) is technically correct for a web-delivered CSRF but should not be interpreted as an open remote attack surface given the same-site prerequisite described in the advisory; no conflicting signals were identified between the CVSS vector and the vulnerability description.

An attacker with a regular forum account embeds a hidden image tag or disguised hyperlink in a forum post, private message, or profile field, with the src or href pointing to the Admin CP URL with action=views&do=set_default and a chosen view ID. When a logged-in administrator loads that content while their ACP session is active, the browser automatically dispatches the GET request to the ACP endpoint, silently overwriting the admin's default user view. No public proof-of-concept code has been identified, but the attack pattern requires no special tooling and is straightforward to construct given the full parameter and endpoint disclosure in the advisory.