Vulnerability in MyBB Forum Software Affects ACP Mass Mail Module

CVE-2026-45127

What is CVE-2026-45127?

A security flaw in the MyBB forum software's ACP Mass Mail module prior to version 1.8.40 permits attackers to exploit request validation weaknesses. Specifically, the module allows same-site attackers to create draft entries from archived emails by utilizing crafted URLs. This occurs during the Resend operation in the Admin Control Panel, leading to improper handling of request forgery protections. Critical aspects include the Conditions of Users & Groups → Mass Mail → Mass Mailing Archive with a specific status in the database ('mybb_massemails.status' set to 0) that lacks adequate security checks during GET requests. The vulnerability has been addressed in version 1.8.40.

References