NamelessMC vulnerabilities

NamelessMC, website software for Minecraft servers, in version 2.2.4 does not enforce blocked/private-profile visibility when adding reactions to profile posts. The file `core/classes/Misc/ProfilePostReactionContext.php` only verifies the post exists. Authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.

In NamelessMC version 2.2.4, ProfilePostReactionContext.php does not enforce blocked/private-profile visibility, and reactions.php allows unauthenticated GET requests. This allows unauthenticated visitors to read reaction details for private posts and low-privileged users to add reactions to private or blocking posts. Fixed in version 2.2.5.

NamelessMC version 2.2.4 processes wall post submissions before verifying profile access permissions. A user with profile.post permission can write to private profiles and inject replies into arbitrary wall posts. Fixed in version 2.2.5.

NamelessMC 2.2.4 fails to enforce topic-level view_other_topics authorization when reading and modifying post reactions. A user who can access the forum but only see their own topics can read and modify reactions on other users' topics. The issue is fixed in version 2.2.5.

NamelessMC, website software for Minecraft servers, in versions 2.2.4 and prior, does not validate the state parameter server-side during OAuth callback. This allows an attacker to capture a valid OAuth callback URL and swap the victim's session to the attacker-linked account (OAuth login CSRF / session swapping).

NamelessMC version 2.2.4 has a vulnerability in modules/Forum/pages/forum/get_quotes.php that allows low-privileged authenticated users to read content from hidden, private, or staff-only forums by enumerating post IDs. The backend does not enforce forum or topic ACLs.

A Reflected XSS vulnerability was found in NamelessMC 2.2.4 in the id parameter of the `/index.php?route=/queries/user/` endpoint. The application reflects user input without proper sanitization, allowing an attacker to inject malicious JavaScript code.