CVE-2026-39903
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8, there is an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php. A single-character operator error causes the permission check to always pass regardless of user permissions.
Risk Assessment
An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve_posts permission. They can also bypass moderation queues for their own uploads and enumerate and delete other users' pending attachments.
Recommendation
Immediately update Simple Machines Forum to a version containing commit 7d048f8 (for version 2.1) or commit a7875e8 (for version 3.0). If an update is not possible, restrict access to attachment management functions to trusted administrators only.
Other vulnerabilities in Simple Machines Forum
See all- CVE-2026-43621High
Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.
- CVE-2026-61520High
Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery (SSRF) vulnerability in the image proxy. Authenticated attackers can embed attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or link-local addresses.
Original NVD description (English source)
Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve_posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments.