Description
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.
Published: 2026-08-18
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises in MyBB’s remote requests feature, where IPv6 addresses are not correctly validated. When hostname resolution for IPv6 yields no result, the verification step in fetch_remote_file() fails open, allowing a crafted URL to bypass host restrictions. This results in a server-side request forgery that lets the forum server perform arbitrary HTTP(S) requests as directed by the attacker. The flaw is identified as a standard SSRF weakness (CWE-918).

Affected Systems

All versions of MyBB installed before 1.8.40 are vulnerable. MyBB is the sole vendor affected, and the flaw was fixed in release 1.8.40, as noted in the vendor’s advisory.

Risk and Exploitability

The CVSS base score of 4.3 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. No authentication requirement is mentioned in the description; therefore, the exploit requires the ability to supply a crafted URL to the remote request function, which may be exposed or restricted depending on the configuration. The vulnerability is limited to versions of MyBB before 1.8.40.

Generated by OpenCVE AI on August 18, 2026 at 19:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MyBB to version 1.8.40 or later where the flaw is fixed.
  • If upgrading is not possible immediately, disable the remote requests feature via configuration.
  • Add IPv6 addresses to the disallowed hosts list to enforce the restriction programmatically.
  • Monitor outbound traffic for suspicious requests originating from the forum application.

Generated by OpenCVE AI on August 18, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Mybb
Mybb mybb
Vendors & Products Mybb
Mybb mybb

Tue, 18 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.
Title MyBB: IPv6 SSRF
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Mybb Mybb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T18:55:56.614Z

Reserved: 2026-05-08T20:08:17.208Z

Link: CVE-2026-45123

cve-icon Vulnrichment

Updated: 2026-08-18T18:55:53.597Z

cve-icon NVD

Status : Received

Published: 2026-08-18T16:17:07.383

Modified: 2026-08-18T19:16:50.017

Link: CVE-2026-45123

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T19:30:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)