CyberRota Analysis
AI-GeneratedThe MyBB forum software prior to version 1.8.40 is vulnerable in the ACP Users View Manager module, where insufficient request validation allows same-site attackers to manipulate an administrator's default user list view via crafted URLs. This vulnerability could lead to unauthorized changes in the admin interface, potentially impacting the management of user permissions and visibility. Administrators of MyBB installations should prioritize upgrading to version 1.8.40 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users & Groups, Users, View Manager changes the administrator's default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.