CVE-2026-35443 Details
Description
NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.
A vulnerability in NamelessMC version 2.2.4 allows users to bypass topic-level authorization when managing forum post reactions. The issue arises in the forum reactions context validation, which only checks if the user can view the forum but fails to enforce restrictions on viewing other users' topics. Consequently, in forums where users are limited to their own topics, they can still read and modify reactions on posts in other topics.
The vulnerability can be addressed by reapplying the topic-level 'view_other_topics' authorization check in the 'ForumPostReactionContext::validateReactable()' method and ensuring that topic visibility is verified before any forum reactions are returned or modified.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NamelessMC | 2.2.4 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |