CVE-2026-45115: MyBB: Buddy/ignore list username XSS
MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialcharsuni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBB Buddy/Ignore listto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which MyBB deployments are affected?
MyBB installations running versions prior to 1.8.40 are affected. The vulnerable paths are the User CP Buddy/Ignore list and the Private Messages Select Buddies popup.
What does exploitation require?
An attacker needs an account or another ability to create a username containing a specially crafted payload. A victim must then either confirm removal of that username from the Buddy/Ignore list or select it in the Private Messages Select Buddies popup.
What remediation is available?
Upgrade MyBB to version 1.8.40, which fixes the issue. The provided information does not specify a workaround for installations that cannot yet be upgraded.
How can I look for possible exploitation attempts?
Review MyBB usernames and the affected Buddy/Ignore and Select Buddies interfaces for usernames containing single quotes or suspicious script-like content. The issue is specifically associated with usernames that are insufficiently escaped by the affected components.