CVE-2026-45128

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The ACP Users View Manager module fails to validate requests properly, enabling same-site attackers to modify a victim administrator's default user list view via a specially crafted URL. This occurs because the set default control within the Admin CP (Users & Groups, Users, View Manager) processes GET requests to change the default view without request forgery protection. The issue is located in the admin/inc/functions view manager.php file.

Recommendations Update to version 1.8.40.