CVE-2026-45125
MediumCVSS 5.3Summary
MyBB before version 1.8.40 in the Email User controller does not sanitize sender names correctly, resulting in mail header injection. The fromname parameter is accepted without sanitization, and when mail_handler is set to the default PHP mail value, the sender name is used in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences.
Risk Assessment
An attacker can inject email headers, potentially leading to phishing, malware distribution, or communication integrity compromise.
Recommendation
Update MyBB to version 1.8.40 or later, which includes a fix for sender name sanitization in the Email User controller.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.