CVE-2026-45120 MyBB: Insufficient authorization for private calendar events

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...

EUVD-2026-61017

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...

CVE-2026-45120

MyBB (free and open source forum software) versions prior to 1.8.40 contain an authorization flaw in the calendar module . The private-event check implemented in get_events() within inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions. This allows use...

CVE-2026-45120

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...

EUVD-2026-61016

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-47245

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

CVE-2026-47245

In MyBB versions prior to 1.8.40, the usercp.php?action=do_editlists delete handler performs a reciprocal buddy-list update that searches for the target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. When array_search() returns false, it i...

CVE-2026-47245 MyBB: Buddy list corruption

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=doeditlists delete handler removes the selected entry from the acting user's list and then updates...

EUVD-2026-61014

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734 MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivatio...

CVE-2026-45734

MyBB versions before 1.8.40 fail to call captcha::invalidate_captcha() in five endpoints (contact.php, member.php actions, sendthread.php), allowing a valid CAPTCHA response to be replayed for low-integrity abuse (spam, password reset floods). CVSS 5.3 MEDIUM. Fixed in 1.8.40; no in-the-wild expl...

CVE-2026-45125

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

CVE-2026-45125

MyBB prior to 1.8.40 is vulnerable to mail header injection via the Email User controller. The fromname HTTP parameter (or stored username) is used unsanitized in Return-Path and Reply-To headers when mail_handler is PHP mail, enabling arbitrary header injection via CRLF sequences. CVSS 5.3 (Medi...

CVE-2026-45125 MyBB: Email User CRLF injection

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

EUVD-2026-61011

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when th...

EUVD-2026-61010

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122 MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...