CVE-2026-35447 Details
Description
NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to write wall posts to private or blocking profiles. Additionally, the reply branch does not verify that the target wall post belongs to the current profile, enabling attackers to inject replies into arbitrary wall posts owned by other profiles via a restricted profile URL. This is patched in version 2.2.5.
A vulnerability in NamelessMC version 2.2.4 allows users with the 'profile.post' permission to bypass privacy settings on profile pages. The issue arises in the profile module's wall post submission process, which fails to properly verify authorization before processing posts and replies. This oversight enables users to post on private or blocked profiles and to inject replies into wall posts of other users via restricted profile URLs.
Users are advised to update to NamelessMC version 2.2.5, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-c9xj-rxgw-g2hq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/NamelessMC/Nameless/security/advisories/GHSA-c9xj-rxgw-g2hq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NamelessMC | 2.2.4 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |