MyBB Forum Software Vulnerability in Admin CP UTF-8 Conversion Module
CVE-2026-45119

4.6MEDIUM

Key Information:

Vendor

Mybb

Status
Mybb
Vendor
CVE Published:
18 August 2026

What is CVE-2026-45119?

MyBB, a popular open-source forum software, contains a vulnerability in the Admin CP UTF-8 Conversion module that could be exploited by same-site attackers. This vulnerability allows attackers to manipulate requests to alter database table encodings, potentially leading to a denial of service. The flawed control flow in the system_health.php file permits unauthorized ALTER TABLE operations through GET requests without proper validation. This issue has been addressed in version 1.8.40, highlighting the importance of ensuring all requests are verified before executing sensitive database operations.

Affected Version(s)

mybb < 1.8.40

References

https://github.com/mybb/mybb/security/advisories/GHSA-p48...
x_refsource_CONFIRM
https://github.com/mybb/mybb/commit/70d445d14c8350cc014be...
x_refsource_MISC
https://github.com/mybb/mybb/releases/tag/mybb_1840
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.