What’s Vulnerable › Vulnerabilities

CVE-2026-35443: NamelessMC: Forum reactions bypass the "view own topics only" restriction

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-02 · updated 2026-07-21
• Weakness: CWE-862

Description

NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.

Affected products

• NamelessMC Nameless: = 2.2.4

References

• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64

Get alerted when CVE-2026-35443 or the next vulnerability affects your stack