MyBB 1.8.41 Released — Security & Maintenance Release

Posted on by

MyBB 1.8.41 is now available, and is a security & maintenance release.

  • 24 security vulnerabilities addressed:

    • High risk: Attachment header suppression XSS (advisory) — reported by valent1
    • Medium risk: Insufficient authorization for draft attachments (advisory) — reported by Nathan Malcolm, Moniruzzaman Prodhan, Aria Akhavan (Haikhavan)
    • Medium risk: Multiquote insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Medium risk: Delayed moderation insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Medium risk: Newreply quote moderator insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Medium risk: Online status insufficient threads authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Medium risk: Search insufficient threads authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Medium risk: ACP Ban group insufficient validation (advisory) — reported by Devilshakerz (MyBB Team)
    • Medium risk: ACP Awaiting Activation group modification (advisory) — reported by Devilshakerz (MyBB Team)
    • Low risk: ACP Awaiting Activation insufficient type distinction (advisory) — reported by Devilshakerz (MyBB Team)
    • Low risk: ACP Login attempt improper restriction (advisory) — reported by Devilshakerz (MyBB Team)
    • Low risk: ACP Users View Manager XSS (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: New Reply insufficient threads authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: New Reply Thread Review insufficient authorization (advisory) — reported by Devilshakerz (MyBB Team)
    • Low risk: Disabled video MyCode XSS (advisory) — reported by Himanshu Anand
    • Low risk: Custom moderator tools insufficient forum authorization (advisory) — reported by Devilshakerz (MyBB Team)
    • Low risk: Attachment moderation insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: Post moderation insufficient destination authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: Mod CP reports insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: Moderation Queue insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: Email User Ignore List insufficient authorization (advisory) — reported by meifukun
    • Low risk: Group Management insufficient authorization (advisory) — reported by meifukun
    • Low risk: Warnings insufficient authorization (advisory) — reported by Aria Akhavan (Haikhavan)
    • Low risk: Image thumbnail memory exhaustion (advisory) — reported by Aria Akhavan (Haikhavan)
  • 6 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team