CVE-2026-45734

Katalog CVE

CVSS 5.3 · Medium EPSS 0,55%

Kerentanan Improper Enforcement of a Single, Unique Action. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.

Rincian

Terbit di NVD

18 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-837: Improper Enforcement of a Single, Unique Action

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/mybb/mybb/commit/c2ed54f9259b9ce05728a9e657169033fe4adffc
• https://github.com/mybb/mybb/releases/tag/mybb_1840
• https://github.com/mybb/mybb/security/advisories/GHSA-jrrr-f3jw-mjmc
• https://mybb.com/versions/1.8.40