CVE-2026-45116 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
MyBB, a widely deployed open-source forum software platform, contains a critical stored cross-site scripting vulnerability within its user data handling subsystem prior to version 1.8.40. The flaw resides specifically in the UserDataHandler class located at inc/datahandlers/user.php, which is responsible for validating and sanitizing profile field inputs during account creation or modification processes. This component fails to enforce strict type checking on checkbox and multiselect profile fields, allowing attackers to inject malicious JavaScript payloads that persist within the database and execute when viewed by other users.
The technical root cause of this vulnerability stems from a logic error in the verify_profile_fields method. The code expects array-based input structures for multi-value fields, typically formatted as profile_fields[fidX][] where fid represents the field ID. However, if an attacker submits data using a non-array structure such as profile_fields[fidX] without the trailing square brackets, the conditional check is_array($profile_fields[$field]) evaluates to false. Consequently, the input bypasses specialized validation routines designed for complex field types and falls through to generic text handling logic. This path lacks sufficient sanitization or encoding mechanisms appropriate for HTML contexts, allowing raw script tags and event handlers to be stored in the user profile database records without alteration.
The operational impact is severe because the unsanitized data is subsequently rendered directly by member.php and inc/functions_post.php when viewing a user's profile or posts. Unlike standard text content which might pass through MyCode parsers that apply escaping, these specific rendering paths output the raw stored value into HTML documents served to victims. This results in persistent cross-site scripting where any authenticated administrator or regular user visiting the compromised profile will execute arbitrary JavaScript code within their browser session context under the authority of the forum domain. Attackers can leverage this capability for account hijacking via cookie theft, keylogging, phishing attacks mimicking legitimate interface elements, or defacement of the application's visual presentation.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored XSS patterns where malicious scripts are permanently stored on target servers. In terms of MITRE ATT&CK framework mapping, this technique corresponds to T1059 Command and Control via Application Layer Protocol or more directly T1189 Drive-by Client Side Web Browser Exploitation depending on the payload delivery mechanism used by the attacker after initial injection. The persistence aspect places it firmly within long-term access strategies aimed at maintaining footholds through compromised user sessions rather than transient exploitation attempts.
Mitigation requires immediate upgrading to MyBB version 1.8.40 or later where this logic gap has been patched with stricter type enforcement and input validation for all profile field types regardless of submission format. Organizations unable to upgrade immediately should implement web application firewall rules that detect and block anomalous HTTP POST requests containing non-array structures in fields expected to be arrays, particularly those targeting user profile endpoints. Additionally, developers must ensure that any custom plugins or modified core files adhere to the same rigorous input validation standards applied by the main codebase to prevent similar bypasses through extended functionality modules.