CVE-2026-35447
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
NamelessMC version 2.2.4 processes wall post submissions before verifying profile access permissions. A user with profile.post permission can write to private profiles and inject replies into arbitrary wall posts. Fixed in version 2.2.5.
Risk Assessment
An attacker can violate user privacy by posting content on profiles they should not have access to.
Recommendation
Update NamelessMC to version 2.2.5.
Other vulnerabilities in NamelessMC
See all- CVE-2026-40571Medium
NamelessMC, website software for Minecraft servers, in version 2.2.4 does not enforce blocked/private-profile visibility when adding reactions to profile posts. The file `core/classes/Misc/ProfilePostReactionContext.php` only verifies the post exists. Authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.
- CVE-2026-40314Medium
In NamelessMC version 2.2.4, ProfilePostReactionContext.php does not enforce blocked/private-profile visibility, and reactions.php allows unauthenticated GET requests. This allows unauthenticated visitors to read reaction details for private posts and low-privileged users to add reactions to private or blocking posts. Fixed in version 2.2.5.
- CVE-2026-35443Medium
NamelessMC 2.2.4 fails to enforce topic-level view_other_topics authorization when reading and modifying post reactions. A user who can access the forum but only see their own topics can read and modify reactions on other users' topics. The issue is fixed in version 2.2.5.
- CVE-2026-34460Medium
NamelessMC, website software for Minecraft servers, in versions 2.2.4 and prior, does not validate the state parameter server-side during OAuth callback. This allows an attacker to capture a valid OAuth callback URL and swap the victim's session to the attacker-linked account (OAuth login CSRF / session swapping).
- CVE-2026-33398High
NamelessMC version 2.2.4 has a vulnerability in modules/Forum/pages/forum/get_quotes.php that allows low-privileged authenticated users to read content from hidden, private, or staff-only forums by enumerating post IDs. The backend does not enforce forum or topic ACLs.
- CVE-2026-32250Medium
A Reflected XSS vulnerability was found in NamelessMC 2.2.4 in the id parameter of the `/index.php?route=/queries/user/` endpoint. The application reflects user input without proper sanitization, allowing an attacker to inject malicious JavaScript code.
Original NVD description (English source)
NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitrary wall posts owned by other profiles via a restricted profile URL. This is patched in version 2.2.5.