CVE-2026-45116
Received Received - Intake

Stored XSS in MyBB Forum Software

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-45116
EUVD
EUVD-2026-61006

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb 1.8.40

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in MyBB forum software versions before 1.8.40. It occurs due to improper validation of checkbox and multiselect profile fields. When a non-array value is provided instead of an expected array, the system treats it as generic text and stores it without verification. Later, this stored value is rendered directly without sanitization, allowing JavaScript code injection.

Detection Guidance

Check MyBB version with: grep -r "$settings['version']" ./inc/settings.php. If version is below 1.8.40, the system is vulnerable. Inspect profile field inputs for non-array values like profile_fields[fidX]=... instead of profile_fields[fidX][]=... in HTTP requests or database entries.

Impact Analysis

An attacker could exploit this to inject malicious scripts into profile fields. When other users view the affected profile, the injected script executes in their browser, potentially stealing session cookies, redirecting to phishing sites, or performing actions on their behalf. This could lead to account compromise or unauthorized access to sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information (PHI) if user profiles contain such data. Non-compliance risks include fines, legal action, and reputational damage due to inadequate security measures.

Mitigation Strategies

Upgrade MyBB to version 1.8.40 or later immediately. If upgrading is not possible, apply the patches from the GitHub commit c32f0c22baab704a68b8d58fcdd2f26fadbbe19b to inc/datahandlers/user.php, inc/functions_post.php, and member.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45116. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart