PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9413 Mybb CVE debrief

CVE-2016-9413 describes a clickjacking issue in the MyBB Admin control panel, affecting MyBB and MyBB Merge System versions before 1.8.7. NVD rates it MEDIUM severity (CVSS 6.5) and notes that successful exploitation requires user interaction. The main risk is tricking an authenticated admin into performing unintended actions through a crafted external page or frame-based attack path.

Vendor
Mybb
Product
CVE-2016-9413
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

MyBB forum administrators, operators of MyBB Merge System deployments, and security teams responsible for any MyBB installation that may still be on a version earlier than 1.8.7.

Technical summary

NVD lists the issue under CWE-284 and maps it to CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. That combination is consistent with a network-reachable attack that depends on user interaction and can impact integrity, especially in an administrative web interface. The vulnerable products and version ranges in NVD are MyBB and MyBB Merge System up to and including 1.8.6.

Defensive priority

Medium

Recommended defensive actions

  • Upgrade MyBB and MyBB Merge System to version 1.8.7 or later.
  • Review any administrative pages that can be embedded or framed and apply clickjacking defenses where supported.
  • Restrict access to the admin control panel to trusted users and networks where practical.
  • Verify that forum administrators are aware of the risk of interacting with untrusted pages while authenticated to the admin interface.
  • Confirm current deployment versions against the affected CPE ranges listed by NVD.

Evidence notes

The supplied NVD record states the vulnerability affects cpe:2.3:a:mybb:mybb and cpe:2.3:a:mybb:merge_system through version 1.8.6, with CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N and CWE-284. The record also cites a MyBB vendor advisory/release reference and Openwall mailing list references. NVD published the CVE record on 2017-01-31 and later modified it on 2026-05-13.

Official resources

Publicly disclosed through the vendor and advisory references cited by NVD; the CVE record was published by NVD on 2017-01-31.