CVE-2026-45125 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open source forum software that facilitates community discussions through threaded messaging and user interaction features. A critical security vulnerability was identified within the Email User controller functionality, specifically affecting versions prior to 1.8.40. This flaw centers on improper input validation and sanitization of sender name fields during email transmission processes initiated by users or guests with appropriate permissions. The vulnerability allows for mail header injection attacks which can lead to significant privacy breaches and potential further exploitation within the application environment.
The technical root cause lies in how the member.php script handles the do_emailuser action when processing HTTP parameters related to message composition. Specifically, the fromname parameter is accepted directly without adequate sanitization when the system uses the default PHP mail handler for sending emails. For authenticated users with cansendemail group permissions enabled, this includes their stored username or custom sender name inputs. When these values are passed into email headers such as Return-Path and Reply-To, they are not filtered against carriage return line feed sequences that separate header fields in SMTP protocols. This lack of validation permits attackers to inject arbitrary additional headers by embedding CRLF characters within the input data.
This vulnerability maps directly to CWE-74 Improper Neutralization of Special Elements used in an Output Document Used to Run a Command, specifically categorized under mail injection variants often associated with CWE-93 Improper Neutralization of CRLF Sequences or CWE-113 HTTP Header Injection. From the perspective of the MITRE ATT&CK framework, this behavior aligns with techniques involving Taint Analysis failures and potentially supports lateral movement if combined with other vectors like phishing via spoofed emails generated through injected headers. The ability to manipulate email headers enables attackers to forge sender identities, bypass anti-spam filters, or redirect replies to unintended recipients thereby compromising confidentiality and integrity of communications within the forum ecosystem.
The operational impact of this flaw is substantial for administrators relying on MyBB for sensitive community interactions. Attackers can exploit the injection capability to send phishing emails that appear legitimate by spoofing trusted sender addresses embedded in Reply-To fields. This facilitates social engineering attacks against other users who receive these messages and trust the apparent source. Additionally, it may allow attackers to exfiltrate data if reply-to addresses are controlled maliciously capturing responses from unsuspecting forum members. In some configurations, header injection could also be leveraged to bypass rate limiting mechanisms or trigger denial of service conditions by flooding mail servers with excessive headers.
Mitigation strategies primarily involve upgrading the MyBB installation to version 1.8.40 where this issue has been resolved through improved input sanitization routines that strip or encode dangerous characters before inclusion in email headers. Administrators unable to upgrade immediately should implement web application firewall rules designed to detect and block HTTP requests containing CRLF sequences within form parameters associated with user profile actions. Furthermore, configuring the mail handler to use a more robust SMTP library rather than relying on PHP built-in functions can provide additional layers of protection since many modern libraries enforce stricter header formatting standards that prevent injection attempts at the protocol level. Regular security audits and monitoring for anomalous email activity patterns remain essential components of defense in depth strategies against such vulnerabilities.