The vulnerability arises from the Email User controller that fails to sanitize the sender name field when the mail_handler defaults to PHP mail. It allows an attacker to inject arbitrary CRLF sequences into the Return-Path and Reply‑To headers, effectively forging email headers. This could be abused to send spam, phishing emails, or manipulate the origin of notifications sent by the forum. The flaw is an instance of Header Injection, identified as CWE‑93.

The affected product is MyBB, specifically the forum software versions prior to 1.8.40. Users with the cansendemail permission (both guests and authenticated users) are subject to this bug. The fix is included in MyBB 1.8.40 and later releases, which properly sanitizes the sender name.

The CVSS base score is 5.3, indicating moderate impact. While an exploit does not grant arbitrary code execution, it does enable manipulation of outbound email, which can be used for phishing or spam. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely web‑based, exploiting the member.php?action=do_emailuser endpoint. Without additional mitigations, the vulnerability could be leveraged by any user with permission to send emails via the forum.