MyBB 1.8.40 Security Update: Fixes for RCE, XSS, SSRF, CSRF (CVE-2026-45115, CVE-2026-45116, CVE-2026-45117, CVE-2026-45118, CVE-2026-45119)

MyBB 1.8.40 Security Update Summary Vulnerability Overview MyBB version 1.8.40 includes fixes for multiple security vulnerabilities, primarily involving the following issues: Buddy/ignore list username XSS Profile field type confusion XSS Installer database configuration RCE Contact page reflected XSS ACP UTF-8 Conversion CSRF Insufficient authorization for private calendar events Insufficient permission check for calendar select Buddy list corruption Insufficient permission check for calendar event move Mod CP report resolution missing authorization IPv6 SSRF Email User CRLF injection ACP Recovery Codes CSRF ACP Questions state CSRF ACP Users View Manager default CSRF ACP Mass Mail draft resend CSRF Default CAPTCHA missing invalidation Security Question insufficient validation Scope of Impact These vulnerabilities may affect forum administrators and users of all MyBB versions prior to 1.8.40. Specific impacts include: XSS (Cross-Site Scripting): May lead to user data leakage or session hijacking. RCE (Remote Code Execution): May result in complete server compromise. CSRF (Cross-Site Request Forgery): May cause users to perform unintended actions. SSRF (Server-Side Request Forgery): May lead to the disclosure of internal network information. CRLF Injection: May lead to email header injection, affecting email delivery. Remediation 1. Upgrade Version: It is recommended that all users immediately upgrade to MyBB 1.8.40. 2. Manual Configuration Updates: - Update the list in the . - Insert two additional CSS lines into the file. 3. Backup Data: Back up forum files and databases before upgrading. 4. Follow Upgrade Documentation: Perform detailed operations according to the official upgrade documentation. Vulnerability Details Buddy/ignore list username XSS - CVE: CVE-2026-45115 - Reporter: Maxim Gofman (Mallory.ai), Shuang Liao (Fudan University) - Risk Level: HIGH RISK Profile field type confusion XSS - CVE: CVE-2026-45116 - Reporter: valent1 - Risk Level: HIGH RISK Installer database configuration RCE - CVE: CVE-2026-45117 - Reporter: Devilshakerz (MyBB Team) - Risk Level: HIGH RISK Contact page reflected XSS - CVE: CVE-2026-45118 - Reporter: Shuang Liao (Fudan University) - Risk Level: MEDIUM RISK ACP UTF-8 Conversion CSRF - CVE: CVE-2026-45119 - Reporter: Devilshakerz (MyBB Team) - Risk Level: MEDIUM RISK Insufficient authorization for private calendar events - CVE: CVE-2026-45120 - Reporter: HuaJHD - Risk Level: MEDIUM RISK Insufficient permission check for calendar select - CVE: CVE-2026-45121 - Reporter: HuaJHD - Risk Level: MEDIUM RISK Buddy list corruption - CVE: CVE-2026-45122 - Reporter: Devilshakerz (MyBB Team) - Risk Level: MEDIUM RISK Insufficient permission check for calendar event move - CVE: CVE-2026-45123 - Reporter: HuaJHD - Risk Level: LOW RISK Mod CP report resolution missing authorization - CVE: CVE-2026-45124 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK IPv6 SSRF - CVE: CVE-2026-45123 - Reporter: Assaf Aleisaif - Risk Level: LOW RISK Email User CRLF injection - CVE: CVE-2026-45125 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK ACP Recovery Codes CSRF - CVE: CVE-2026-45129 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK ACP Questions state CSRF - CVE: CVE-2026-45126 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK ACP Users View Manager default CSRF - CVE: CVE-2026-45128 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK ACP Mass Mail draft resend CSRF - CVE: CVE-2026-45127 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK Default CAPTCHA missing invalidation - CVE: CVE-2026-45734 - Reporter: Himanshu Anand - Risk Level: LOW RISK Security Question insufficient validation - CVE: CVE-2026-46482 - Reporter: Devilshakerz (MyBB Team) - Risk Level: LOW RISK Other Important Information Stability Fixes: This version includes stability fixes, adding control for post icon functionality and removing the deprecated Google Hangouts profile field. Configuration File Update: The list in the has been modified and requires manual replacement/updates. CSS Update: Two additional CSS lines must be manually inserted into the file. Upgrade Steps 1. Backup: Back up forum files and databases before upgrading. 2. Overwrite Files: Copy and overwrite the files. 3. Run Upgrade Script: Execute the script. 4. Follow Documentation: Perform detailed operations according to the official upgrade documentation. Contributors Buddy/ignore list management technical reflected XSS weakness - Reporter: Shuang Liao (Fudan University) Contact page open redirect weakness - Reporter: Himanshu Anand Resolved Issues 31 Resolved Issues: See GitHub Issues. Changelog 159 Changed Files: See Changelog List. --- This summary covers the main security update contents of the MyBB 1.8.40 version, including vulnerability overview, scope of impact, remediation, and related details. It is recommended that users upgrade as soon as possible to ensure forum security.

Goal Reached Thanks to every supporter — we hit 100%!

MyBB 1.8.40 Security Update: Fixes for RCE, XSS, SSRF, CSRF (CVE-2026-45115, CVE-2026-45116, CVE-2026-45117, CVE-2026-45118, CVE-2026-45119)