CVE-2026-45125 MyBB: Email User CRLF injection
Attackers can inject arbitrary mail headers via CRLF sequences in the Email User feature, potentially spoofing sender details or manipulating email routing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45125?
CVE-2026-45125 is a medium-severity vulnerability in mybb, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.
Weakness: CWE-93
Which versions are affected by CVE-2026-45125?
How do I fix CVE-2026-45125?
No fix has been published for CVE-2026-45125 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45125 being exploited?
There is no known exploitation of CVE-2026-45125 in the wild and no public exploit code.
Sources
Also known as GHSA-f626-53q9-pqm9.