CVE-2026-45126

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The Admin CP Security Questions module fails to correctly validate the anti-CSRF (Cross-Site Request Forgery) token, which is a unique token used to prevent unauthorized commands from being transmitted from a user that the web application trusts. This allows same-site attackers to enable or disable registration challenge questions using a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb questions.active without verifying the my post key token. This issue is located in the admin/modules/config/questions.php file.

Recommendations Update to version 1.8.40.