The vulnerability is a CSRF flaw in the ACP Mass Mail module prior to version 1.8.40. A crafted URL can trigger the Resend route in the Admin Control Panel to duplicate archived mailing entries into new draft records with a status of 0, without any request forgery protection. This means an attacker who can get an administrator to open the link can create unwanted mass mail drafts that could later be used to send spam or phishing emails. The flaw does not grant code execution or full system compromise, but it does allow the attacker to alter data and potentially influence user communications. The weakness is classified as CWE-352, Regular Cross‑Site Request Forgery.

It affects MyBB forum software versions earlier than 1.8.40, specifically the ACP Mass Mail module accessed via Users & Groups → Mass Mail → Mass Mailing Archive under the admin/modules/user/mass_mail.php path.

With a CVSS score of 3.5 the flaw is considered low severity, and no EPSS score is available, indicating exploit frequency is uncertain. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that no widely observed exploits exist as of the data available. The attack vector is inferred to be same‑site, relying on an administrator being tricked into clicking a malicious link. Because the flaw allows only the creation of drafts and does not directly lead to data exfiltration or remote code execution, the overall risk is modest but still relevant for organizations that send mass mailings. Applying the 1.8.40 fix removes the request forgery check and nullifies the attack.