MyBB 1.8.5/1.6.17 Security Release: Fixes Auth Bypass, XSS, and CSRF Vulnerabilities

Critical Vulnerability Information MyBB 1.8.5 - Security and Maintenance Release Fixed Vulnerabilities and Issues: Fixed 6 security vulnerabilities and 58 reported issues that caused MyBB to malfunction. - Medium Risk: Reset password code check can be bypassed to authorize members - Reported by: solati.sadegh - Medium Risk: Sender email can be forged when sending emails - Reported by: online developers - Medium Risk: Permission check missing when searching posts using old session ID - Reported by: pedder55655 - Medium Risk: Cross-site scripting in quick edit feature in xmlhttp.php - Reported by: TiberiusG - Low Risk: Cross-site request forgery in ACP mass email cancellation - Reported by: Destroy666 - Low Risk: Creating "duplicate" usernames using U+200E Unicode character - Reported by: mahdy2021 Note: No upgrade script needs to be run to upgrade to this version. During the upgrade, 12 language files and 9 templates were modified or added. MyBB 1.6.17 - Security Release Fixed Vulnerabilities: 2 medium-risk vulnerabilities and 5 low-risk vulnerabilities. - Medium Risk: Reset password code check can be bypassed to authorize members - Reported by: solati.sadegh - Medium Risk: Permission check missing when searching posts using old session ID - Reported by: pedder55655 - Low Risk: Cross-site request forgery in ACP mass email cancellation - Reported by: Destroy666 - Low Risk: Creating "duplicate" usernames using U+200E Unicode character - Reported by: mahdy2021 - Low Risk: Multiple cross-site scripting vulnerabilities requiring admin privileges - Reported by: adamzijaja, Devilshakerz, DingjieYang, and sroesemann - Low Risk: Cross-site request forgery in ACPot login - Reported by: Devilshakerz - Low Risk: Cache handler using var_export without encoding check - Reported by: chtg Note: No upgrade script needs to be run to upgrade to this version. No changes to language files or templates during the upgrade.

Goal Reached Thanks to every supporter — we hit 100%!

MyBB 1.8.5/1.6.17 Security Release: Fixes Auth Bypass, XSS, and CSRF Vulnerabilities