---
id: CVE-2026-46482
title: >-
  ### Impact

  The registration component does not validate the text-based _Security
  Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a
  specially crafted value.



  [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](http…
summary: >-
  ### Impact

  The registration component does not validate the text-based _Security
  Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a
  specially crafted value.



  [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](http…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-636
published: '2026-08-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:02:26.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46482'
references:
  - url: >-
      https://github.com/mybb/mybb/commit/bd2a3447939d3084a5926dd66ece04649e0e0d60
    label: security-advisories@github.com
  - url: 'https://github.com/mybb/mybb/releases/tag/mybb_1840'
    label: security-advisories@github.com
  - url: 'https://github.com/mybb/mybb/security/advisories/GHSA-v2h7-4jp7-j6hh'
    label: security-advisories@github.com
  - url: 'https://mybb.com/versions/1.8.40'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00328
epssPercentile: 0.26181
ingestedAt: '2026-09-08T21:11:12.280Z'
---

## Overview

### Impact
The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value.


[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

### Details
The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error.

### Patches
MyBB 1.8.(...) resolves this issue with the following changes:

- Commit: https://github.com/mybb/mybb/commit/
  - `.patch`: https://github.com/mybb/mybb/commit/.patch

### References
- Release Notes: https://mybb.com/versions/1.8.(...)/

### For more information
Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB.

### Contact
The security team can be reached at [security@mybb.com](mailto:security@mybb.com).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.