NamelessMC CVE-2026-35443

Q: What is the CVSS score of CVE-2026-35443?

CVE-2026-35443 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33975 MEDIUM

Missing Authorization (CWE-862)

2026-06-02 GitHub_M

PHP Authentication Bypass

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:34 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

5.3 (MEDIUM)

DescriptionGitHub Advisory

NamelessMC is website software for Minecraft servers. In version 2.2.4, modules/Forum/classes/ForumPostReactionContext.php only verifies that the caller can view the forum, but it does not re-enforce topic-level view_other_topics authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.

AnalysisAI

NamelessMC 2.2.4's forum module exposes a broken object-level authorization flaw that allows authenticated users to read and modify reactions on topics they are explicitly forbidden from viewing. The vulnerability exists in modules/Forum/classes/ForumPostReactionContext.php, which enforces only forum-level access (can view the forum) but omits the topic-level view_other_topics permission check - meaning the access control boundary is incomplete by design. Attackers with a low-privilege forum account in a restricted forum can bypass the view_other_topics restriction to interact with other users' topic reactions. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

NamelessMC is an open-source PHP web application used to build websites for Minecraft game servers. The forum subsystem implements hierarchical permission controls: a user may have access to enter a forum but be restricted by the view_other_topics permission from reading topics authored by others. The affected class ForumPostReactionContext.php handles reading and writing of emoji-style reactions on forum posts. CWE-862 (Missing Authorization) is the root cause - specifically, the authorization gate for forum-entry permission is applied, but the secondary per-topic authorization layer is never re-checked within the reaction context. This is a classic incomplete mediation or broken object-level authorization (BOLA/IDOR) pattern common in PHP applications where permission checks are scattered across controller logic rather than enforced at the data layer. The CPE string cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* covers all NamelessMC versions, though the vulnerability is specifically confirmed in version 2.2.4.

RemediationAI

Upgrade to NamelessMC version 2.2.5, which introduces topic-level view_other_topics authorization enforcement within ForumPostReactionContext.php. The fix is confirmed by the vendor via GitHub Security Advisory GHSA-wcrf-5gcp-pf64 at https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64. For operators unable to patch immediately, a compensating control is to remove or avoid using the view_other_topics restriction feature in any forum category - this eliminates the permission disparity that the bypass exploits, though it broadens topic visibility for all users in that forum, which may conflict with intended moderation design. Alternatively, restricting forum membership to fully trusted users removes the untrusted actor from the threat model. There is no known server-side configuration toggle to disable the reaction API independently without code modification.