CVE-2026-45119

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The Admin CP UTF-8 Conversion module fails to validate certain requests correctly. This allows same-site attackers to alter table encoding and cause a denial of service using a specially crafted URL. Specifically, the do=all control flow in the 'admin/modules/tools/system health.php' endpoint performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table specified by the table parameter without proper request verification.

Recommendations Update to version 1.8.40.