Vulnerability · Published Jun 2, 2026 · Assigned by GitHub_M

CVE-2026-35443NamelessMC: Forum reactions bypass the "view own topics only" restriction

Medium 5.3

In plain English

A medium-severity missing authorization in Nameless from NamelessMC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
NamelessMC	Nameless	= 2.2.4

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64 x_refsource_CONFIRM