NamelessMC CVE-2026-35443

Exploitation requires an authenticated account with at least low-level forum access (PR:L per CVSS vector - a registered forum member). The critical enabling condition is that the targeted forum must be configured with a view_other_topics restriction applied to the attacker's user group, meaning the forum operator has intentionally limited topic visibility. Without this specific permission configuration, the view_other_topics bypass has no effect because no restriction exists to bypass. Exploitation is further limited to the reaction sub-feature of the forum module - it does not grant access to full post content, private messages, or other forum data. The attack is network-accessible with no user interaction required, but requires knowledge of valid topic IDs in the restricted forum.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) reflects a remotely exploitable, low-complexity flaw requiring only low-privilege authentication - consistent with any registered forum member account. The dual low-impact ratings (VC:L, VI:L) accurately reflect the narrow scope: confidentiality impact is limited to leaking reaction metadata (not post content), and integrity impact is limited to unauthorized reaction placement or removal. There is no availability impact and no scope change to subsequent systems. No EPSS score was provided in the available data, and this CVE is not present in the CISA KEV catalog, suggesting no confirmed or widespread active exploitation. The practical real-world risk is low: the attack is constrained to forums explicitly configured with view_other_topics restrictions, and the data exposed - reactions, not post body content - is of minimal sensitivity. This is a real authorization defect worth patching but not an emergency priority absent other escalating signals.

An authenticated NamelessMC forum member in a forum configured with view_other_topics disabled crafts HTTP requests directly to the forum reaction endpoint, specifying the IDs of topics created by other users. Despite lacking permission to view those topics in the forum UI, the reaction context class does not block the request, allowing the attacker to enumerate reaction data on restricted topics or place/remove reactions - revealing that those topics exist and that the attacker interacted with them. No public exploit code has been identified at time of analysis.