Simple Machines Forum CVE-2026-39903

Exploitation requires an authenticated low-privileged SMF account (PR:L) on an install running 2.1.x before 2.1.8 or 3.0 before 3.0 Alpha 5, and requires that the forum's attachment moderation queue is in use so that pending attachments exist to manipulate. No approve_posts permission, no user interaction, and no special client are needed - the broken check in AttachmentApprove.php passes for any logged-in user. Limiting factors: the attacker must be able to register or already possess an account (so forums with closed/approved registration or no untrusted members are far less exposed), and impact is confined to attachment approval/rejection/deletion and enumeration of pending attachments rather than broader site control; boards with attachment posting or moderation disabled present little to no exploitable surface.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) scores 7.1 High and aligns well with the description: network-reachable, low complexity, requires only a low-privileged authenticated account, no user interaction, primarily an integrity impact (unauthorized moderation actions) with limited availability impact (attachment deletion) and, per the vendor, no confidentiality impact. This is a real and easily reproducible authorization flaw rather than an inflated high-CVSS issue, but its blast radius is bounded: an attacker must already hold a forum account, and the impact is confined to the attachment moderation workflow, not full site compromise or code execution. EPSS was not provided, and there is no KEV listing or public POC, so exploitation should be treated as plausible-but-not-observed. One point of tension worth noting: the description says an attacker can 'enumerate' other users' pending attachments, which implies some confidentiality exposure, yet the vendor set VC:N - defenders concerned about data exposure should verify the enumeration behavior against the patched code.

A registered forum member with no moderation rights logs in and sends the same HTTP request the attachment-approval action expects, targeting pending attachments on boards they do not moderate. Because the permission check always passes, they approve their own queued uploads to bypass moderation, or enumerate and delete other users' pending attachments across arbitrary boards. The attack is low-complexity and needs only a standard authenticated session; no public exploit code is identified at time of analysis, but the flaw is trivial to reproduce once the vulnerable parameter/action is known.