Security readout for executives and security teams
Plain-English summary
MyBB versions before 1.8.40 contain a contact-page flaw that can send users to an attacker-controlled destination and execute browser script after they select a redirect link. Successful abuse could expose sensitive browser-accessible information or enable actions in the user’s forum session. User interaction is required.
Executive priority
Treat this as an urgent internet-facing application update. Patch public MyBB forums promptly, prioritizing systems with administrative use or sensitive session data. Although no active exploitation is established in the supplied evidence, the critical score, unauthenticated reachability, and potential browser-session impact justify accelerated remediation.
Technical view
The Contact module accepts a redirect target from the HTTP “from” parameter or Referer header and passes it to redirect() without adequate URL or protocol validation. With forced redirects enabled, an unsafe URI can populate the fallback link, creating open-redirect and reflected script-injection behavior. MyBB 1.8.40 fixes the issue.
Likely exposure
Internet-accessible MyBB installations running versions earlier than 1.8.40 are potentially exposed when contact.php is reachable. Risk is greatest where authenticated administrators or other privileged users could be persuaded to follow a crafted request and select the displayed redirect link. The supplied sources do not quantify affected deployments.
Exploitation context
The CVSS 3.1 score is 9.3, reflecting network reachability, low complexity, no required privileges, user interaction, and cross-scope confidentiality and integrity impact. The supplied bundle says this CVE is not in KEV and provides no evidence of active exploitation. Exploitation still requires a victim to select the redirect link.
Researcher notes
The issue is identified as CWE-83. Relevant input sources are $mybb->input['from'] and $_SERVER['HTTP_REFERER']; the sink is redirect() with forced redirect behavior. The fallback link is the interaction point. The bundle does not provide exploitation telemetry, affected deployment counts, or detailed patch internals, so those points remain unverified.
Mitigation direction
- Upgrade affected MyBB installations to version 1.8.40 or later.
- Prioritize public forums and installations used by privileged administrators.
- Review the MyBB advisory and release guidance before applying the update.
- Limit contact.php exposure temporarily if upgrading cannot be completed promptly.
Validation and detection
- Inventory MyBB installations and confirm their deployed versions.
- Verify every installation is running MyBB 1.8.40 or later.
- Identify whether contact.php is reachable from untrusted networks.
- After upgrading, confirm redirect targets receive the vendor’s intended validation.
- Review relevant web logs for unusual contact-page requests and external redirect values.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-83: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-45118 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N2.85.8GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mybb/mybb/security/advisories/GHSA-wf92-5q5h-qr53CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/mybb/mybb/releases/tag/mybb_1840CVE reference, GitHub_M · x_refsource_MISC
- https://mybb.com/versions/1.8.40CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Script in Attributes in a Web Page
Improper Neutralization of Script in Attributes in a Web Page represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.