The vulnerability resides in the Admin CP Security Questions module of MyBB, where GET requests used to enable or disable the registration challenge questions do not properly validate the anti‑CSRF token. A same‑site attacker who can send a crafted URL while logged in as an administrator can therefore toggle the availability of these security questions without the user’s consent, weakening the protection of the registration process. This flaw is a classic example of improper CSRF protection (CWE‑352).

MyBB forum software, any release older than 1.8.40. The issue is located in the admin module at admin/modules/config/questions.php and impacts all installations that have not applied the 1.8.40 upgrade. The CNA product catalog lists mybb:mybb as the affected vendor and product.

With a CVSS score of 3.5 the vulnerability is considered low severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited current exploitation activity. The attack vector is inferred to be same‑site: an attacker must be able to invoke the URL while an authenticated admin session is active. No remote or privileged escalation beyond the ability to manipulate the registration questions setting is required.