CVE-2026-47245

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The User CP Buddy/Ignore List component fails to validate reciprocal buddy-list updates correctly. When the delete handler in the 'usercp.php?action=do editlists' endpoint is used, the system removes an entry from the acting user's list and attempts to update the mybb users.buddylist for the target account. The process incorrectly searches for the deleted target UID instead of the acting user's UID and uses the unchecked return value of the array search() function as an array key. Because a false result can be converted to index 0, the first stored buddy of the target account may be removed while the actual reciprocal entry remains unchanged.

Recommendations Update to version 1.8.40.