CVE-2026-45115 Overview
CVE-2026-45115 is a stored cross-site scripting (XSS) vulnerability in MyBB, an open source forum software package. Versions prior to 1.8.40 fail to sanitize usernames correctly in the Buddy/Ignore component. Attackers can register a specially crafted username that injects JavaScript into other users' browsers. The flaw stems from the htmlspecialchars_uni() function leaving single quotes unescaped in the User CP Buddy/Ignore list and the Select Buddies list in Private Messages. The vulnerability is categorized as Cross-Site Scripting [CWE-79].
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victims' browser sessions, enabling session hijacking, credential theft, and account takeover including administrator accounts.
Affected Products
- MyBB forum software versions prior to 1.8.40
- MyBB User CP Buddy/Ignore list component
- MyBB Private Messages Select Buddies list (xmlhttp.php)
Discovery Timeline
- 2026-08-18 - CVE-2026-45115 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-45115
Vulnerability Analysis
The vulnerability resides in how MyBB processes usernames within the Buddy/Ignore feature. Usernames flow through the htmlspecialchars_uni() helper before being embedded into HTML contexts. This helper does not escape single quote characters by default. When the resulting output is placed inside a JavaScript string delimited by single quotes, the attacker breaks out of the string context and injects arbitrary code.
Two sinks expose the flaw. The User CP Buddy/Ignore management page renders usernames inside a confirmation dialog triggered when a user selects Yes in Please Confirm to remove an entry from usercp.php. The Private Messages Select Buddies popup rendered by xmlhttp.php places the username inside an onclick handler. Both contexts permit single-quote escape and script execution.
Successful exploitation runs in the victim's authenticated session. An attacker can steal session cookies, forge requests on behalf of moderators or administrators, or pivot to further stored injections across the forum.
Root Cause
The root cause is improper output encoding for the JavaScript string context. htmlspecialchars_uni() is a wrapper around PHP's htmlspecialchars() that omits the ENT_QUOTES flag for single quotes. Rendering user-controlled data inside single-quoted JavaScript literals without additional escaping breaks the trust boundary between HTML and script contexts.
Attack Vector
An attacker registers a MyBB account with a username containing crafted single quotes and JavaScript payloads. The attacker then arranges for a victim to interact with the Buddy/Ignore removal confirmation or the Select Buddies popup, which reflects the malicious username. Exploitation requires low privileges (a registered account) and user interaction.
No verified proof-of-concept code has been published. Technical details are available in the GitHub Security Advisory GHSA-p766-qqxv-rfc2.
Detection Methods for CVE-2026-45115
Indicators of Compromise
- Registered usernames containing single quote characters, HTML entities, or JavaScript keywords such as alert, onerror, or onclick
- Outbound requests from user browsers to attacker-controlled domains shortly after visiting usercp.php or opening the Select Buddies popup
- Unexpected administrator or moderator actions originating from valid session tokens
Detection Strategies
- Query the MyBB users table for usernames matching regular expressions containing ', <, >, or javascript: substrings
- Inspect web server logs for requests to xmlhttp.php and usercp.php that correlate with anomalous downstream requests to third-party domains
- Review Content Security Policy violation reports if CSP is deployed in front of the forum
Monitoring Recommendations
- Alert on new account registrations whose usernames contain non-alphanumeric characters typical of injection payloads
- Monitor forum administrator sessions for unusual privilege changes, plugin installations, or template edits following buddy list interactions
- Enable and centralize web server access logs covering /usercp.php, /private.php, and /xmlhttp.php endpoints
How to Mitigate CVE-2026-45115
Immediate Actions Required
- Upgrade MyBB to version 1.8.40 or later without delay
- Audit the users table for existing accounts whose usernames contain single quotes or HTML metacharacters and disable suspicious accounts
- Force password rotation for administrator and moderator accounts that may have interacted with malicious usernames
Patch Information
The issue is fixed in MyBB 1.8.40. Download the release from the MyBB 1.8.40 release page or review the MyBB Version 1.8.40 Overview. The fix updates username output encoding so single quotes are escaped in the affected JavaScript contexts.
Workarounds
- Restrict new account registration to trusted users until the upgrade is applied
- Add server-side validation that rejects usernames containing quotes, angle brackets, or backticks
- Deploy a Content Security Policy that disallows inline event handlers and inline scripts to blunt exploitation
# Upgrade MyBB to the patched release
cd /var/www/mybb
wget https://github.com/mybb/mybb/releases/download/mybb_1840/mybb_1840.zip
unzip mybb_1840.zip -d mybb_1840
# Follow the official MyBB upgrade procedure in install/upgrade.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
