FKIE_CVE-2026-46482

Vulnerability from fkie_nvd - Published: 2026-08-18 16:17 - Updated: 2026-09-08 21:02
Severity
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) ### Details The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error. ### Patches MyBB 1.8.(...) resolves this issue with the following changes: - Commit: https://github.com/mybb/mybb/commit/ - `.patch`: https://github.com/mybb/mybb/commit/.patch ### References - Release Notes: https://mybb.com/versions/1.8.(...)/ ### For more information Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB. ### Contact The security team can be reached at [security@mybb.com](mailto:security@mybb.com).
References
security-advisories@github.comhttps://github.com/mybb/mybb/commit/bd2a3447939d3084a5926dd66ece04649e0e0d60
security-advisories@github.comhttps://github.com/mybb/mybb/releases/tag/mybb_1840
security-advisories@github.comhttps://github.com/mybb/mybb/security/advisories/GHSA-v2h7-4jp7-j6hh
security-advisories@github.comhttps://mybb.com/versions/1.8.40
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mybb",
          "vendor": "mybb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.40"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "### Impact\nThe registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value.\n\n\n[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n### Details\nThe public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` \u2014 expected to match the question session identifier (`mybb_questionsessions.sid`) \u2014 and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error.\n\n### Patches\nMyBB 1.8.(...) resolves this issue with the following changes:\n\n- Commit: https://github.com/mybb/mybb/commit/\n  - `.patch`: https://github.com/mybb/mybb/commit/.patch\n\n### References\n- Release Notes: https://mybb.com/versions/1.8.(...)/\n\n### For more information\nGo to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB.\n\n### Contact\nThe security team can be reached at [security@mybb.com](mailto:security@mybb.com)."
    }
  ],
  "id": "CVE-2026-46482",
  "lastModified": "2026-09-08T21:02:26.047",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-46482",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-18T17:44:40.432629Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T16:17:09.350",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mybb/mybb/commit/bd2a3447939d3084a5926dd66ece04649e0e0d60"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mybb/mybb/releases/tag/mybb_1840"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mybb/mybb/security/advisories/GHSA-v2h7-4jp7-j6hh"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://mybb.com/versions/1.8.40"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-636"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.