CVE-2026-45123
MediumCVSS 4.3Summary
MyBB before version 1.8.40 in the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses, and verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result for IPv6, allowing a crafted remote target to bypass the host restriction.
Risk Assessment
An attacker can exploit SSRF to access internal network resources, potentially leading to data leakage or further attacks.
Recommendation
Update MyBB to version 1.8.40 or later, which includes a fix for IPv6 handling in the remote requests feature.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.