CVE-2026-45125

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The Email User controller fails to properly sanitize sender names, leading to mail header injection. The endpoint 'member.php?action=do emailuser' accepts the fromname parameter for guests or the stored username for authenticated users when the cansendemail group permission is active. If the mail handler is configured to the default PHP mail value, the sender name is inserted into Return-Path and Reply-To headers without sanitization, allowing the injection of arbitrary headers via CRLF (Carriage Return Line Feed) sequences. CRLF sequences are special characters used to signify the end of a line of text.

Recommendations Update to version 1.8.40.