MyBB Forum Software Vulnerability in Buddy/Ignore List Component

CVE-2026-47245

What is CVE-2026-47245?

MyBB forum software prior to version 1.8.40 contains a vulnerability in the User CP Buddy/Ignore List component. This flaw arises from improper validation of reciprocal buddy-list updates, which can lead to unintended deletions. Specifically, during the execution of the delete handler in usercp.php, the update mechanism mistakenly searches for the deleted target UID rather than the acting user's UID. Consequently, a false result can be utilized as an array key, inadvertently causing the first entry of the target account's buddy list to be deleted while leaving the reciprocal entry intact. Users are advised to upgrade to version 1.8.40 or later to mitigate this risk.

References