CVE-2026-45127

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The ACP Mass Mail module fails to correctly validate certain requests, enabling same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. Specifically, the Resend route within the Admin CP (Users & Groups, Mass Mail, Mass Mailing Archive) duplicates archived mailing entries into new drafts by setting mybb massemails.status to 0 during GET requests that lack request forgery protection. This occurs within the admin/modules/user/mass mail.php file.

Recommendations Update to version 1.8.40.