MyBB’s Buddy/Ignore List handler in versions prior to 1.8.40 fails to validate the return value of array_search when removing a buddy entry. The function can return false, which is treated as 0 and used as an array key, causing the entry at index 0—normally the first stored buddy—to be deleted instead of the intended target. The attacker can, by deleting entries, corrupt the buddy list of another user while the reciprocal entry remains unchanged. The flaw does not allow code execution or information disclosure; it only leads to unintended data modification consistent with a Data Integrity violation. The weakness underlying this issue is the lack of validation for function return values (CWE‑252).

All installations of MyBB forum software whose Buddy list component had not yet been updated to version 1.8.40 are affected. The vulnerability stems from the mybb:mybb product and targets users with access to the User CP Buddy/Ignore List feature. The bug was fixed in the 1.8.40 release available from the official MyBB website and GitHub repository.

The CVSS score of 4.3 indicates a low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply navigating to the User CP and issuing a delete action for a buddy entry; no elevated privileges or network access are required. Because the impact is limited to accidental removal of a list entry, the risk to confidentiality, integrity, or availability is low to moderate. The potential for denial of service or user annoyance exists, but the overall likelihood of exploitation and harm remains modest.