CVE-2026-33398
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
NamelessMC version 2.2.4 has a vulnerability in modules/Forum/pages/forum/get_quotes.php that allows low-privileged authenticated users to read content from hidden, private, or staff-only forums by enumerating post IDs. The backend does not enforce forum or topic ACLs.
Risk Assessment
Authenticated users can access sensitive forum content that should be restricted.
Recommendation
Update NamelessMC to version 2.2.5 which fixes the issue.
Other vulnerabilities in NamelessMC
See all- CVE-2026-40571Medium
NamelessMC, website software for Minecraft servers, in version 2.2.4 does not enforce blocked/private-profile visibility when adding reactions to profile posts. The file `core/classes/Misc/ProfilePostReactionContext.php` only verifies the post exists. Authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.
- CVE-2026-40314Medium
In NamelessMC version 2.2.4, ProfilePostReactionContext.php does not enforce blocked/private-profile visibility, and reactions.php allows unauthenticated GET requests. This allows unauthenticated visitors to read reaction details for private posts and low-privileged users to add reactions to private or blocking posts. Fixed in version 2.2.5.
- CVE-2026-35447Medium
NamelessMC version 2.2.4 processes wall post submissions before verifying profile access permissions. A user with profile.post permission can write to private profiles and inject replies into arbitrary wall posts. Fixed in version 2.2.5.
- CVE-2026-35443Medium
NamelessMC 2.2.4 fails to enforce topic-level view_other_topics authorization when reading and modifying post reactions. A user who can access the forum but only see their own topics can read and modify reactions on other users' topics. The issue is fixed in version 2.2.5.
- CVE-2026-34460Medium
NamelessMC, website software for Minecraft servers, in versions 2.2.4 and prior, does not validate the state parameter server-side during OAuth callback. This allows an attacker to capture a valid OAuth callback URL and swap the victim's session to the attacker-linked account (OAuth login CSRF / session swapping).
- CVE-2026-32250Medium
A Reflected XSS vulnerability was found in NamelessMC 2.2.4 in the id parameter of the `/index.php?route=/queries/user/` endpoint. The application reflects user input without proper sanitization, allowing an attacker to inject malicious JavaScript code.
Original NVD description (English source)
NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/pages/forum/get_quotes.php` only checks whether the caller is logged in, then reads a post by attacker-controlled `post` ID and returns its content. The backend helper in `modules/Forum/classes/Forum.php` does not enforce forum or topic ACLs. In contrast, the normal topic page in `modules/Forum/pages/forum/view_topic.php` enforces forum visibility and `view_other_topics`. Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums. Version 2.2.5 fixes the issue.