CVE-2026-46482

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.(...)

Description The registration component fails to correctly validate the text-based Security Question CAPTCHA, which allows attackers to bypass the challenge using a specially crafted value. In the public registration workflow at the endpoint 'member.php?action=do register', the system accepts a hidden field question id that should match the question session identifier mybb questionsessions.sid. The validation process lacks a fail-closed fallback for invalid identifiers; consequently, if the question id is blank, forged, or expired, the request proceeds without triggering a question-related error.

Recommendations Update MyBB to version 1.8.(...) or later.