CVE-2026-47245 mybb CVE debrief

Who should care

MyBB administrators, users with elevated access to user accounts, and security teams responsible for monitoring and maintaining MyBB installations should be aware of this vulnerability. These stakeholders should verify their installations and configurations to ensure they are not vulnerable to unintended modifications of user buddy lists. Additionally, they should monitor user account activity and review buddy list configurations for potential unauthorized

Why it matters

CVE-2026-47245 is a medium-severity vulnerability in MyBB's User CP Buddy/Ignore List component. It allows for unintended modifications to a user's buddy list, potentially leading to unauthorized changes. MyBB administrators and users with elevated access should verify their installations and configurations.

• Potential unintended modifications to user buddy lists
• Verification of buddy list configurations for unauthorized changes
• Monitoring user account activity for suspicious behavior

Technical summary

The User CP Buddy/Ignore List component in MyBB prior to 1.8.40 does not correctly validate reciprocal buddy-list updates. This can result in the unintended removal of a buddy from the target user's list. The issue is due to the incorrect use of the array_search() return value as an array key, which can lead to unauthorized modifications of user buddy lists. This vulnerability can be mitigated by updating to MyBB version 1.8.40 or later. Affected MyBB installations should prioritize this update to prevent potential exploitation.

Defensive priority

Medium priority for MyBB administrators and users with elevated access to user accounts

Recommended defensive actions

• Update MyBB to version 1.8.40 or later
• Review and verify buddy list configurations for potential unauthorized modifications
• Monitor user account activity for suspicious behavior
• Perform a thorough review of user buddy lists for any unintended modifications
• Implement additional monitoring to detect potential exploitation attempts
• Verify the integrity of user accounts and buddy lists regularly
• Conduct a security audit of MyBB installations to identify potential vulnerabilities

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The issue is fixed in MyBB version 1.8.40. Limited details are available about potential exploitation or impact. Further verification is recommended to ensure the security of MyBB installations. The CVE record and NVD entry provide the primary sources for this information. No additional exploitation details are publicly available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.