CVE-2026-40314
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In NamelessMC version 2.2.4, ProfilePostReactionContext.php does not enforce blocked/private-profile visibility, and reactions.php allows unauthenticated GET requests. This allows unauthenticated visitors to read reaction details for private posts and low-privileged users to add reactions to private or blocking posts. Fixed in version 2.2.5.
Risk Assessment
Private user posts can be read by unauthorized parties, and low-privileged users can interact with private content, violating privacy and access control.
Recommendation
Update NamelessMC to version 2.2.5.
Other vulnerabilities in NamelessMC
See all- CVE-2026-40571Medium
NamelessMC, website software for Minecraft servers, in version 2.2.4 does not enforce blocked/private-profile visibility when adding reactions to profile posts. The file `core/classes/Misc/ProfilePostReactionContext.php` only verifies the post exists. Authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.
- CVE-2026-35447Medium
NamelessMC version 2.2.4 processes wall post submissions before verifying profile access permissions. A user with profile.post permission can write to private profiles and inject replies into arbitrary wall posts. Fixed in version 2.2.5.
- CVE-2026-35443Medium
NamelessMC 2.2.4 fails to enforce topic-level view_other_topics authorization when reading and modifying post reactions. A user who can access the forum but only see their own topics can read and modify reactions on other users' topics. The issue is fixed in version 2.2.5.
- CVE-2026-34460Medium
NamelessMC, website software for Minecraft servers, in versions 2.2.4 and prior, does not validate the state parameter server-side during OAuth callback. This allows an attacker to capture a valid OAuth callback URL and swap the victim's session to the attacker-linked account (OAuth login CSRF / session swapping).
- CVE-2026-33398High
NamelessMC version 2.2.4 has a vulnerability in modules/Forum/pages/forum/get_quotes.php that allows low-privileged authenticated users to read content from hidden, private, or staff-only forums by enumerating post IDs. The backend does not enforce forum or topic ACLs.
- CVE-2026-32250Medium
A Reflected XSS vulnerability was found in NamelessMC 2.2.4 in the id parameter of the `/index.php?route=/queries/user/` endpoint. The application reflects user input without proper sanitization, allowing an attacker to inject malicious JavaScript code.
Original NVD description (English source)
NamelessMC is website software for Minecraft servers. In version 2.2.4,`core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. `modules/Core/queries/reactions.php` allows unauthenticated GET requests for reaction details. This means that unauthenticated visitors can read reaction participants and timestamps for private profile posts and uthenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 fixes the issue.