CVE-2026-45116: MyBB Forum Software XSS Vulnerability

CVE-2026-45116 Overview

CVE-2026-45116 is a stored cross-site scripting (XSS) vulnerability in MyBB, the open source forum software. The flaw resides in the user datahandler, which fails to validate checkbox and multiselect profile field types when the submitted value is not an array. Attackers with a low-privilege account can submit a scalar profile_fields[fidX] value that bypasses the specialized validation branch in UserDataHandler::verify_profile_fields(). The unsanitized payload is later rendered directly by member.php and inc/functions_post.php, resulting in stored JavaScript execution in the browsers of viewing users. The issue is fixed in MyBB 1.8.40.

Critical Impact

An authenticated attacker can inject persistent JavaScript into profile fields and posts, enabling session hijacking, forum takeover, and administrator account compromise.

Affected Products

• MyBB forum software versions prior to 1.8.40
• Deployments exposing checkbox or multiselect custom profile fields
• Any MyBB instance where profile fields are rendered on member.php or in postbits

Discovery Timeline

• 2026-08-18 - CVE-2026-45116 published to NVD
• 2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45116

Vulnerability Analysis

The vulnerability is a type confusion condition [CWE-79] in the MyBB user datahandler. The function UserDataHandler::verify_profile_fields() in inc/datahandlers/user.php contains a conditional branch that runs the specialized allow-list validation only when is_array($profile_fields[$field]) returns true. Checkbox and multiselect fields normally arrive as profile_fields[fidX][] array payloads, so the array check succeeds during typical use. An attacker can craft a request containing profile_fields[fidX] as a scalar string rather than an array. Because the type check fails, the value skips the field-specific verification and falls through to generic text handling. The stored value is not run through the MyCode parser or otherwise sanitized before rendering.

Root Cause

The root cause is an over-restrictive guard clause that couples type validation with type coercion. The original code executed the checkbox and multiselect option verification only when the input was already an array, and treated any other shape as free-form text. This design assumed the client would submit the expected array structure, but attackers control the request body directly.

Attack Vector

Exploitation requires an authenticated forum account with permission to edit its own profile. The attacker submits a profile update request that sets a checkbox or multiselect custom profile field to a scalar HTML payload. The payload persists in the database and executes when other users view the attacker's profile via member.php or view posts where the field appears in the postbit.

// Security patch in inc/datahandlers/user.php
// Fix Profile field type confusion XSS (CVE-2026-45116)

// Sort out multiselect/checkbox profile fields.
$options = '';
-if(($type == "multiselect" || $type == "checkbox") && is_array($profile_fields[$field]))
+if($type == "multiselect" || $type == "checkbox")
 {
+    if(!is_array($profile_fields[$field]))
+    {
+        $profile_fields[$field] = array();
+    }
+
     $expoptions = explode("\n", $thing[1]);
     $expoptions = array_map('trim', $expoptions);
     foreach($profile_fields[$field] as $value)

Source: MyBB commit c32f0c2. The patch removes the is_array() short-circuit so the field-type branch always runs, and coerces non-array input to an empty array before iterating options.

// Defense-in-depth fix in inc/functions_post.php
{
    if($val != '')
    {
+        $val = htmlspecialchars_uni($val);
+
        eval("\$post['fieldvalue_option'] .= \"".$templates->get("postbit_profilefield_multiselect_value")."\";");
    }
}

Source: MyBB commit c32f0c2. The postbit renderer now applies htmlspecialchars_uni() before evaluating the template for multiselect values.

Detection Methods for CVE-2026-45116

Indicators of Compromise

• Profile field values in the mybb_userfields table containing <script>, on*=, or javascript: substrings
• Unexpected outbound requests from forum visitors' browsers to attacker-controlled domains after viewing member profiles
• Administrator sessions authenticating from anomalous IP addresses shortly after visiting a user profile page

Detection Strategies

• Query the mybb_userfields table for entries in checkbox or multiselect fields where the value contains HTML tags or quotes rather than the expected option identifiers
• Inspect web server access logs for POST requests to usercp.php or the profile update endpoint containing profile_fields[fid parameters with non-array syntax
• Compare the type column of mybb_profilefields against stored values in mybb_userfields to flag type mismatches

Detection Strategies

Monitoring Recommendations

• Monitor administrative account activity for privilege changes, new admin accounts, or template modifications originating from active forum sessions
• Alert on Content Security Policy (CSP) violation reports from browsers viewing forum pages, if CSP is deployed
• Track edits to custom profile fields and forum templates via the Admin CP audit log

How to Mitigate CVE-2026-45116

Immediate Actions Required

• Upgrade all MyBB installations to version 1.8.40 or later without delay
• Audit existing user profile fields for stored HTML or JavaScript payloads and sanitize or remove them
• Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found

Patch Information

The fix is available in MyBB 1.8.40 and detailed in GHSA-4p6g-p3qh-559v. The patch modifies inc/datahandlers/user.php so the checkbox and multiselect verification branch always runs, and adds htmlspecialchars_uni() output encoding in inc/functions_post.php. Release notes are available at the MyBB 1.8.40 version page.

Workarounds

• Temporarily disable custom checkbox and multiselect profile fields via the Admin CP until the upgrade is applied
• Restrict profile editing permissions for untrusted user groups to reduce the attack surface
• Deploy a Web Application Firewall (WAF) rule to block profile_fields[fid parameters that contain HTML tag characters

# Upgrade MyBB to the patched release
cd /var/www/mybb
wget https://resources.mybb.com/downloads/mybb_1840.zip
unzip mybb_1840.zip -d mybb_1840
rsync -av mybb_1840/Upload/ ./ --exclude=inc/config.php --exclude=inc/settings.php
php install/upgrade.php