CVE-2026-45116 MyBB: Profile field type confusion XSS
Attackers can inject stored JavaScript via malformed profile fields, leading to code execution and potential account takeover in MyBB forums.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45116?
CVE-2026-45116 is a high-severity cross-site scripting vulnerability in mybb, published on 18 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40.
Weakness: CWE-79
Which versions are affected by CVE-2026-45116?
How do I fix CVE-2026-45116?
No fix has been published for CVE-2026-45116 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-45116 being exploited?
There is no known exploitation of CVE-2026-45116 in the wild and no public exploit code.
Sources
Also known as GHSA-4p6g-p3qh-559v.