CVE-2026-45125: MyBB: Email User CRLF injection
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=doemailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mailhandler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40 - Compensating control
If you cannot upgrade immediately, disable or restrict the Email User feature by removing users/guests from the cansendemail group permission so member.php?action=do_emailuser cannot accept the fromname HTTP parameter (guests) or stored username (authenticated users) for CRLF header-injection into Return-Path/Reply-To when mail_handler is set to the default PHP mail value.
Event History
Frequently Asked Questions
Who can exploit this issue and under what conditions?
Instances running a version prior to 1.8.40 are affected when the mail handler uses the default PHP mail setting. Guest exploitation uses the fromname parameter, while authenticated users can supply their stored username if their group has the cansendemail permission.
What can an attacker do with a successful exploit?
An attacker can inject arbitrary email headers by placing CRLF sequences in the relevant sender name value. The described impact is limited to header injection; no confidentiality or availability impact is stated.
What is the remediation?
Upgrade MyBB to version 1.8.40. The issue is fixed in that release.
How can I determine whether my deployment is exposed?
Review whether the instance is below 1.8.40, uses the default PHP mail handler, and permits access to the Email User functionality. Also check whether guest-supplied fromname values or usernames of email-enabled users could contain CRLF sequences.