Description

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T16:17:06.180Z",
  "pubdate": "2026-08-18T16:17:06.180Z",
  "executiveSummary": "A vulnerability exists in the MyBB forum software prior to version 1.8.40 within the Buddy/Ignore component, specifically involving improper sanitization of usernames. This flaw allows malicious actors to perform JavaScript code injection by utilizing specially crafted usernames containing unescaped single quotes.\nThe impact of this security deficiency includes potential cross-site scripting (XSS) execution in the context of a victim user's session when interacting with specific UI components. This may lead to unauthorized actions performed on behalf of the user, session compromise, or interaction with sensitive application data.\nThe affected product is MyBB versions prior to 1.8.40. The risk implications involve potential exploitation against authenticated users interacting with the User CP Buddy/Ignore list or the Select Buddies list in Private Messages.\nAttacker capabilities require the ability to register or modify a username with a malicious payload designed to break out of string contexts due to unescaped single quotes. Exploitation requirements involve victim interaction, specifically requiring a user to confirm the removal of the username in usercp.php or selecting the malicious username through the onclick handler in the xmlhttp.php Select Buddies popup.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization of usernames within the Buddy/Ignore component of MyBB prior to version 1.8.40. Specifically, the User CP Buddy/Ignore list and the Select Buddies list in Private Messages utilize the htmlspecialchars_uni() function to process usernames.\nThis sanitization implementation leaves single quotes unescaped under certain contexts, allowing attackers to inject arbitrary JavaScript code by breaking out of JavaScript string literals or HTML attributes where the username is dynamically rendered.\nThe vulnerable components include the User CP Buddy/Ignore management interface (usercp.php) and the Select Buddies popup functionality (xmlhttp.php). Affected versions include all MyBB deployments prior to 1.8.40.\nThe exploitation flow proceeds as follows: First, an attacker establishes an account or modifies an existing profile to include a specially crafted username containing JavaScript payloads and unescaped single quotes. Second, the victim navigates to the User CP Buddy/Ignore list and initiates the removal of the malicious username, triggering the Please Confirm prompt where the payload executes upon selecting Yes. Alternatively, the victim opens the Select Buddies popup via xmlhttp.php during Private Message composition and clicks the malicious username, which executes the payload via the associated onclick event handler.\nWhen triggered, the injected payload executes arbitrary JavaScript within the Document Object Model (DOM) of the victim's browser session, inheriting the victim's privileges and session context within the MyBB application."
}