CVE-2026-45123
Received Received - Intake

Server-Side Request Forgery in MyBB Forum Software

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-08
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-07
NVD
CVE-2026-45123
EUVD
EUVD-2026-61051

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb 1.8.40

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in MyBB forum software versions before 1.8.40. It occurs because the system fails to properly handle IPv6 addresses in remote requests. The default blocked host list does not include IPv6 addresses, and verification fails when IPv6 lookups return no results. This allows attackers to bypass restrictions and make unauthorized requests to IPv6 addresses.

Detection Guidance

To detect this vulnerability, check if your MyBB installation is running a version prior to 1.8.40. Run the command: grep -r "1.8.3" /path/to/mybb/inc/settings.php or check the version in the Admin CP. If vulnerable, inspect network logs for unexpected outbound IPv6 requests to disallowed hosts.

Impact Analysis

An attacker could exploit this to make your server send requests to internal systems or restricted IPv6 addresses. This might expose internal services, bypass firewalls, or interact with other systems under your control without authorization. The impact is limited as it requires some user interaction and has low severity.

Compliance Impact

This vulnerability could potentially impact compliance by allowing unauthorized network requests that might expose sensitive data or systems. However, the low severity and specific conditions required for exploitation limit its direct regulatory impact. Organizations should still patch to maintain security controls.

Mitigation Strategies

Upgrade MyBB to version 1.8.40 or later immediately. If upgrading is not possible, manually update inc/functions.php to handle IPv6 addresses in get_ip_by_hostname and fetch_remote_file functions. Add IPv6 ranges to the disallowed_remote_addresses list in install/index.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart