CVE-2026-47245

Beschreibung

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user-s list and then updates mybb_users.buddylist for the target account. The reciprocal update searches for the deleted target UID instead of the acting user-s UID and uses the unchecked array_search() return value as an array key. A false result can be converted to index 0, removing the target account-s first stored buddy while leaving the actual reciprocal entry unchanged. The uniquely identifying implementation details include false converted to index 0. This issue is fixed in version 1.8.40.