CVE-2026-45116: MyBB: Profile field type confusion XSS
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verifyprofilefields() only performs the specialized validation when isarray($profilefields[$field]) is true. A non-array profilefields[fidX] value instead of the expected profilefields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functionspost.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which installations are affected?
MyBB installations running versions earlier than 1.8.40 are affected when they use checkbox or multiselect custom profile fields. Version 1.8.40 contains the fix.
What does an attacker need to exploit this?
An attacker needs a MyBB account with permission to submit or update profile field data and must persuade a victim to view a page that renders the affected profile-field value. The attack can be delivered over the network with low complexity, but requires user interaction from the victim.
What should I do if I cannot patch immediately?
Upgrade MyBB to version 1.8.40. If an immediate upgrade is not possible, identify checkbox and multiselect profile fields and review stored values for unexpected non-array submissions or JavaScript content, especially values rendered through member.php or inc/functions_post.php.
How can I check for possible exploitation?
Review custom checkbox and multiselect profile-field records for values that do not match the expected profile_fields[fidX][] array form and for embedded JavaScript. The vulnerable validation path accepts a non-array profile_fields[fidX] value as generic text and stores it without the specialized validation.