CVE-2026-47245

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-47245

In MyBB versions prior to 1.8.40, the usercp.php?action=do_editlists delete handler performs a reciprocal buddy-list update that searches for the target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. When array_search() returns false, it i...