CVE-2026-47245
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
MyBB, free and open source forum software, before version 1.8.40 in the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. Deleting an entry from the acting user's list updates the target account's buddy list, but the reciprocal search uses the deleted target UID instead of the acting user's UID, and the unchecked array_search() return value can be used as an array key, potentially removing the target account's first stored buddy.
Risk Assessment
An attacker can manipulate other users' buddy lists, potentially leading to data integrity issues or unauthorized profile changes.
Recommendation
Update MyBB to version 1.8.40 or later, which includes a fix for reciprocal buddy-list update validation.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user's UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account's first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.