Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-39903Simple Machines Forum Authorization Bypass via AttachmentApprove.php

High 7.1

In plain English

A high-severity incorrect authorization in SMF from SimpleMachines. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 59.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve_posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments.

Affected products (as reported)

VendorProductVersions
SimpleMachines SMF 2.1.0 – through 2.1.73.0.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References