CVE-2026-45125: MyBB Mail Header Injection Vulnerability

CVE-2026-45125 Overview

CVE-2026-45125 is a mail header injection vulnerability in MyBB, an open source forum software package. The flaw exists in the Email User controller (member.php?action=do_emailuser), which fails to sanitize sender names before passing them to the mail handler. When mail_handler is set to the default PHP mail value, the sender name is embedded in Return-Path and Reply-To headers without filtering. Attackers can inject arbitrary headers using CRLF (Carriage Return Line Feed) sequences. The issue affects all MyBB versions prior to 1.8.40 and is tracked under [CWE-93] (Improper Neutralization of CRLF Sequences).

Critical Impact
Unauthenticated guests can inject arbitrary email headers through the fromname parameter, enabling spam relay, phishing, and email spoofing that abuse the forum's sending identity.

Affected Products

MyBB forum software versions prior to 1.8.40
Installations with the cansendemail group permission enabled
Deployments using the default PHP mail handler configuration

Discovery Timeline

2026-08-18 - CVE-2026-45125 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45125

Vulnerability Analysis

The vulnerability resides in MyBB's Email User feature, which allows forum users to send messages to other members through the site's mailer. The member.php controller accepts the fromname HTTP parameter from guests, or uses the stored username for authenticated users when the cansendemail group permission is granted. The value is passed to my_mail() and concatenated into the sender identity used to build Return-Path and Reply-To headers.

Because the sender name is not sanitized, CRLF characters in fromname terminate the current header and inject additional ones. Attackers can append Bcc, To, or Content-Type headers, or inject an entire secondary message body. The forum's own outbound mail infrastructure becomes the delivery agent for the injected content.

Root Cause

The root cause is missing neutralization of newline characters in mail header construction inside inc/class_mailhandler.php. The from and from_named properties were populated directly from user input without a cleanup routine. In the pre-patch code path in member.php, the sender string "{$mybb->input['fromname']} <{$mybb->input['fromemail']}>" was passed as the final from argument to my_mail(), propagating unsanitized input into SMTP envelope headers.

Attack Vector

The attack requires no authentication when guest email is permitted. An attacker submits a POST request to member.php?action=do_emailuser with a crafted fromname value containing URL-encoded CRLF sequences followed by injected headers. The mail handler emits these headers verbatim, enabling third-party recipients, silent Bcc lists, or replacement of the Content-Type to smuggle HTML payloads.

php

// Patch: inc/class_mailhandler.php
// Adds cleanup() call to strip CRLF from sender fields before header assembly
 			$this->from_named .= " <".$this->from.">";
 		}
 
+		$this->from = $this->cleanup($this->from);
+		$this->from_named = $this->cleanup($this->from_named);
+
 		if($return_email)
 		{
 			$this->return_email = $return_email;

Source: MyBB commit 5046c56b

php

// Patch: member.php
// Removes user-controlled fromname from the sender string passed to my_mail()
 	if(count($errors) == 0)
 	{
-		if($mybb->settings['mail_handler'] == 'smtp')
-		{
-			$from = $mybb->input['fromemail'];
-		}
-		else
-		{
-			$from = "{$mybb->input['fromname']} <{$mybb->input['fromemail']}>";
-		}
-
 		$message = $lang->sprintf($lang->email_emailuser, $to_user['username'], $mybb->input['fromname'], $mybb->settings['bbname'], $mybb->settings['bburl'], $mybb->get_input('message'));
-		my_mail($to_user['email'], $mybb->get_input('subject'), $message, '', '', '', false, 'text', '', $from);
+		my_mail($to_user['email'], $mybb->get_input('subject'), $message, '', '', '', false, 'text', '', $mybb->input['fromemail']);

Source: MyBB commit 5046c56b

Detection Methods for CVE-2026-45125

Indicators of Compromise

Outbound email logs showing multiple Bcc recipients originating from the MyBB installation's mailer.
Web server access logs containing POST requests to member.php?action=do_emailuser with unusually long or URL-encoded fromname parameter values.
Sudden increase in bounce messages or spam complaints attributed to the forum's sending domain.

Detection Strategies

Inspect the fromname field in mybb_maillogs (when mail_logging is enabled) for values containing %0d, %0a, \r, \n, or literal Bcc: and Content-Type: strings.
Deploy a Web Application Firewall (WAF) rule that blocks CRLF byte sequences in POST parameters targeting member.php.
Alert on MyBB installations still running versions below 1.8.40 by fingerprinting the /index.php output and version files.

Monitoring Recommendations

Correlate mail transfer agent (MTA) logs against forum email dispatch events to identify divergence in recipient counts.
Monitor DNS-based Authentication of Named Entities failures and DMARC aggregate reports for spoofing attempts using the forum domain.
Track guest access to the Email User endpoint and rate-limit requests per source IP.

How to Mitigate CVE-2026-45125

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which introduces sanitization in class_mailhandler.php and removes user-controlled sender construction in member.php.
Temporarily disable the Email User feature by revoking the cansendemail permission for guest and low-trust user groups until patching completes.
Review outbound mail queues and forum mail logs for evidence of exploitation prior to patch application.

Patch Information

The fix is included in the MyBB 1.8.40 release and documented in the MyBB Security Advisory GHSA-f626-53q9-pqm9. Release notes are also available on the MyBB 1.8.40 version page. The remediation adds a cleanup() call against both from and from_named properties and eliminates concatenation of fromname into the mail sender argument.

Workarounds

Switch mail_handler to smtp in the Admin Control Panel so the sender string bypasses the vulnerable PHP mail code path.
Set the cansendemail group permission to No for all user groups until the upgrade is deployed.
Add WAF or reverse-proxy filtering that rejects requests with CRLF byte sequences in the fromname or fromemail parameters.

bash

# ModSecurity rule example to block CRLF injection in MyBB Email User requests
SecRule REQUEST_URI "@contains member.php" \
    "chain,phase:2,deny,status:403,id:1045125,msg:'CVE-2026-45125 CRLF in fromname'"
    SecRule ARGS:fromname "@rx (?:%0[ad]|\r|\n)" "t:lowercase,t:urlDecodeUni"