What’s Vulnerable › Vulnerabilities

CVE-2026-45125: MyBB: Email User CRLF injection

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-09-08
• Weakness: CWE-93

Description

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.

Affected products

• mybb: before 1.8.40

References

• https://github.com/mybb/mybb/commit/5046c56b515d4593297a4f65b0c6ccb0b55baa01
• https://github.com/mybb/mybb/releases/tag/mybb_1840
• https://github.com/mybb/mybb/security/advisories/GHSA-f626-53q9-pqm9
• https://mybb.com/versions/1.8.40

Get alerted when CVE-2026-45125 or the next vulnerability affects your stack