MyBB: 18 Vulnerabilities Including Critical Flaws Disclosed Together, Patched in 1.8.40
Key findings • 18 vulnerabilities disclosed for MyBB on August 18, 2026, patched in version 1.8.40. • Two critical vulnerabilities (CVSSv3 9.3 and 9.8) include RCE via installer and open redi…
Key findings
- 18 vulnerabilities disclosed for MyBB on August 18, 2026, patched in version 1.8.40.
- Two critical vulnerabilities (CVSSv3 9.3 and 9.8) include RCE via installer and open redirect with XSS.
- Multiple issues involve improper input validation leading to code injection and CAPTCHA bypasses.
- Permission and access control flaws affect modules like Calendar, Mod CP, and Admin CP.
- Users are urged to update to MyBB 1.8.40 to address these widespread security risks.
On August 18, 2026, a significant batch of 18 vulnerabilities was disclosed for MyBB, a popular free and open-source forum software. These vulnerabilities, all patched in version 1.8.40, range in severity from Low to Critical, with two critical flaws carrying CVSS scores of 9.3 and 9.8. The disclosures highlight issues across various MyBB components, including its installer, contact module, calendar, and user management features.
Several vulnerabilities center on improper input validation and sanitization, leading to code injection and other security risks. CVE-2026-45116 and CVE-2026-45115, both rated High, involve stored JavaScript code injection due to improper validation of profile field types and unsanitized usernames in the Buddy/Ignore list, respectively. Similarly, CVE-2026-45118, a Critical vulnerability, stems from the Contact module's failure to correctly validate redirect URLs and protocols, leading to open redirects and reflected JavaScript code injection.
The MyBB installer module is implicated in CVE-2026-45117, a Critical vulnerability (CVSSv3 9.8). This flaw allows for PHP code injection and remote code execution if the installer is still accessible, by improperly escaping user-supplied database configuration values. This is particularly concerning as it could allow an attacker to take full control of a compromised MyBB installation.
Other vulnerabilities include bypasses of security mechanisms. CVE-2026-46482 and CVE-2026-45734, both Medium severity, detail how the registration component's security question CAPTCHA and the built-in CAPTCHA system can be bypassed through specially crafted values or challenge replay, respectively. Additionally, CVE-2026-45126, a Low severity issue, allows same-site attackers to create draft entries from archived entries in the Mass Mail module via a crafted URL.
Permission and access control issues are also present. CVE-2026-45125 (Medium) allows moderators without report-management permissions to resolve reports in the Mod CP Report Center. CVE-2026-45122 and CVE-2026-45121 (both Medium) relate to the calendar module, with the former allowing users to move events to calendars they don't have moderation permissions for, and the latter enabling authenticated users to access titles of otherwise inaccessible calendars. CVE-2026-45120 (Medium) involves the calendar module's inconsistent verification of private event status, allowing users with viewing and moderation permissions to access and moderate private events.
Several vulnerabilities, including CVE-2026-45129 (Medium) and CVE-2026-45119 (Medium), involve the Admin CP modules. The Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate administrator recovery codes, while the UTF-8 Conversion module allows alteration of table encoding and denial of service. Low severity issues like CVE-2026-45128 and CVE-2026-45127 affect the ACP Users View Manager and Mass Mail modules, respectively, allowing same-site attackers to alter user views or create draft entries via crafted URLs.
CVE-2026-45123 (Medium) highlights a server-side request forgery vulnerability due to incorrect handling of IPv6 addresses in the remote requests feature. Finally, CVE-2026-47245 (Medium) involves an incorrect validation of reciprocal buddy-list updates in the User CP Buddy/Ignore List component.
All 18 vulnerabilities were addressed in MyBB version 1.8.40. Users are strongly advised to update to this version to mitigate the risks associated with these diverse security flaws. The sheer number and severity of these vulnerabilities underscore the importance of timely patching for MyBB installations.