Description

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T16:17:07.667Z",
  "pubdate": "2026-08-18T16:17:07.667Z",
  "executiveSummary": "An improper neutralization of CRLF sequences vulnerability exists in the Email User controller of MyBB prior to version 1.8.40. The vulnerability allows unauthenticated attackers via the fromname HTTP parameter, or authenticated users depending on group permissions and stored usernames, to perform mail header injection. When the mail_handler configuration is set to the default PHP mail value, the application fails to correctly sanitize sender names before incorporating them into Return-Path and Reply-To email headers. Successful exploitation enables malicious actors to inject arbitrary email headers via Carriage Return and Line Feed (CRLF) characters. This flaw poses significant risks to mail server integrity, potentially facilitating phishing campaigns, spam relaying, or the manipulation of email routing and metadata. Exploitation requires network access to the target forum application and relies on the default PHP mail transport mechanism being active alongside specific user or guest input handling configurations.",
  "technicalDetails": "The vulnerability resides within the member.php file, specifically in the action=do_emailuser handler responsible for the Email User controller functionality in MyBB. The root cause is the lack of proper input sanitization and validation on the sender name parameter before it is passed to underlying mail functions. Specifically, the application processes the fromname HTTP parameter when requests are made by guests, or retrieves the stored username for authenticated users who possess the cansendemail group permission. When the application configuration employs mail_handler set to the default PHP mail value, these sender name values are directly concatenated into critical email headers, notably the Return-Path and Reply-To headers, without stripping or encoding CRLF sequences such as \\r\\n.\nThe attack flow proceeds as follows: An adversary crafts a malicious HTTP request targeting member.php?action=do_emailuser. The attacker injects CRLF sequences coupled with arbitrary email headers (such as CC, BCC, Subject, or additional body content) into the fromname parameter. Because the vulnerable component inadequately sanitizes the input, the underlying mail subsystem interprets the injected CRLF characters as structural header delimiters rather than literal string data. Consequently, the newly introduced headers are appended to the outgoing mail transmission generated by the PHP mail function.\nThe vulnerable component is the Email User controller within member.php affecting MyBB versions prior to 1.8.40. Authentication requirements vary depending on forum configuration; unauthenticated attackers can leverage the fromname HTTP parameter if guest email sending is permitted, whereas authenticated users require the cansendemail group permission. The attack vector is entirely network-based via HTTP/HTTPS. Payload behavior involves manipulating the SMTP or mail transport transaction by breaking out of the intended header context. Post-exploitation impact includes the ability to forge arbitrary email communications originating from the trusted forum server, bypass security filters, launch phishing attacks against forum members or third parties, and potentially compromise the reputation and operational status of the hosting mail server."
}