CVE-2026-33398

Summary

NamelessMC is website software for Minecraft servers. In version 2.2.4, modules/Forum/pages/forum/get_quotes.php only checks whether the caller is logged in, then reads a post by attacker-controlled post ID and returns its content. The backend helper in modules/Forum/classes/Forum.php does not enforce forum or topic ACLs. In contrast, the normal topic page in modules/Forum/pages/forum/view_topic.php enforces forum visibility and view_other_topics. Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums. Version 2.2.5 fixes the issue.

Affected Software

Weaknesses

• CWE-285: CWE-285: Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx

References

• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx

• ←Previous
• Next→