Which versions of NamelessMC are affected by CVE-2026-33398?

NamelessMC 2.2.4 contains a broken access control vulnerability allowing authenticated users to retrieve content from private, hidden, and staff-only forums via crafted requests to the get_quotes.php…

How to fix or mitigate CVE-2026-33398?

Within 24 hours: Identify all NamelessMC 2.2.4 instances in production; enable detailed logging on the get_quotes.php endpoint to establish baseline access and detect exploitation attempts. Within 7 days: Deploy Web Application Firewall rules blocking get_quotes.php requests except from authorized administrator roles; audit forum ACL configuration; notify forum administrators of potential data exposure risk. Within 30 days: Monitor vendor communications for patched version availability; plan and execute controlled upgrade to patched release; conduct forensic review of access logs for indicators of prior unauthorized access to sensitive forums.

NamelessMC CVE-2026-33398

Q: What is the CVSS score of CVE-2026-33398?

CVE-2026-33398 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33949 HIGH

Improper Authorization (CWE-285)

2026-06-02 GitHub_M

PHP Authentication Bypass Nameless

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 18:06 vuln.today

CVSS changed

Jun 02, 2026 - 16:22 NVD

7.1 (HIGH)

CVE Published

Jun 02, 2026 - 15:19 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

NamelessMC is website software for Minecraft servers. In version 2.2.4, modules/Forum/pages/forum/get_quotes.php only checks whether the caller is logged in, then reads a post by attacker-controlled post ID and returns its content. The backend helper in modules/Forum/classes/Forum.php does not enforce forum or topic ACLs. In contrast, the normal topic page in modules/Forum/pages/forum/view_topic.php enforces forum visibility and view_other_topics. Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums. Version 2.2.5 fixes the issue.

AnalysisAI

Broken access control in NamelessMC 2.2.4 (Minecraft community website software) allows any low-privileged authenticated user to read posts from hidden, private, or staff-only forums by sending crafted requests to the get_quotes.php endpoint. The Forum module's quote helper only verifies that the caller is logged in and fails to enforce forum/topic visibility ACLs that the normal topic view does enforce. No public exploit identified at time of analysis, but the issue is trivial to weaponize given an account on the affected site.

Technical ContextAI

NamelessMC is a PHP-based website and user management platform widely deployed by Minecraft server operators to provide forums, user accounts, and Minecraft-account linking. The flaw sits in the Forum module: modules/Forum/pages/forum/get_quotes.php accepts an attacker-controlled post ID and dispatches into a helper in modules/Forum/classes/Forum.php that does not consult forum-level visibility or the view_other_topics permission - checks that the canonical view_topic.php path correctly performs. This is a classic CWE-285 Improper Authorization case where two code paths reach the same underlying resource (forum post content) but only one enforces the ACL, creating a parallel route around the access control model. The CPE (cpe:2.3:a:namelessmc:nameless) narrows the affected component to the core NamelessMC application rather than a third-party module.

RemediationAI

Vendor-released patch: upgrade NamelessMC to 2.2.5, which adds the missing forum and topic ACL enforcement in the Forum helper as described in advisory GHSA-2r6x-cv4f-h8fx (https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx). If immediate upgrade is not possible, operators can apply web-server-level restrictions on the /modules/Forum/pages/forum/get_quotes.php path - for example denying it via .htaccess or nginx location blocks - which disables the quote-on-reply UX but eliminates the unauthorized read path; alternatively, tighten registration (disable open sign-up, require admin approval) to reduce the pool of accounts able to abuse the endpoint, and audit hidden-forum contents on the assumption they may already have been read. Side effect of blocking get_quotes.php is loss of the inline quote feature when composing forum replies.