CVE-2026-33398 Details
Description
NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/pages/forum/get_quotes.php` only checks whether the caller is logged in, then reads a post by attacker-controlled `post` ID and returns its content. The backend helper in `modules/Forum/classes/Forum.php` does not enforce forum or topic ACLs. In contrast, the normal topic page in `modules/Forum/pages/forum/view_topic.php` enforces forum visibility and `view_other_topics`. Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums. Version 2.2.5 fixes the issue.
A vulnerability in NamelessMC version 2.2.4 allows low-privileged authenticated users to access hidden forum posts through the 'get_quotes.php' endpoint. The issue arises because the forum module does not properly enforce access control lists (ACLs) for forums or topics. While the 'view_topic.php' page correctly manages forum visibility and topic access rights, 'get_quotes.php' only verifies if a user is logged in before retrieving post content based on an attacker-specified post ID. This flaw enables enumeration of post IDs and access to content from private, hidden, or staff-only forums.
Users are advised to update to NamelessMC version 2.2.5, which addresses this vulnerability by applying the necessary authorization checks and enforcing topic and forum ACL validations before post content is returned.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NamelessMC | 2.2.4 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |