NamelessMC CVE-2026-35447

The attacker must hold a valid NamelessMC account with the profile.post permission assigned to their user group - this is a non-default permission that must be explicitly granted by an administrator, representing the primary limiting factor. For the wall post bypass, the target profile must be configured as private or must have the attacker blocked; publicly accessible profiles where the attacker is not blocked are unaffected since no authorization bypass is needed. For the reply injection flaw, the attacker additionally needs knowledge of a valid wall post ID on the restricted profile, which may require prior reconnaissance or enumeration. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), meaning once prerequisites are met, exploitation is straightforward. Exploitation is bounded to the NamelessMC application layer and does not affect the underlying server or other hosted applications.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) reflects a network-accessible, low-complexity vulnerability requiring only low-level privileges (profile.post permission) with no user interaction needed. Both confidentiality and integrity impacts on the vulnerable system are rated Low, with no impact on subsequent systems - this is consistent with a content-injection flaw rather than a code execution or privilege escalation scenario. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, so there is no confirmed evidence of active exploitation. No public proof-of-concept has been identified at time of analysis. The realistic risk is content harassment and privacy violation - attackers can spam private profiles or manipulate wall conversations across the platform - rather than system compromise. For Minecraft community sites with active social features, the integrity impact to user trust and moderation workflows could be disproportionate to the raw CVSS score. Priority should be elevated for deployments where profile privacy or block features are actively used by their communities.

An authenticated NamelessMC user who holds the profile.post permission identifies the profile URL of a user who has blocked them or set their profile to private. The attacker submits a crafted wall post form targeting that restricted profile - because the authorization check occurs after the write, the post is persisted to the victim's wall before the rejection fires. Separately, the attacker discovers the ID of a wall post on a restricted profile and submits a reply via that restricted profile's URL, injecting the reply into a conversation they have no legitimate access to. No public exploit code has been identified, but the attack requires no special tooling beyond a standard browser and authenticated session.