Which versions of Simple Machines Forum are affected by CVE-2026-39903?

Simple Machines Forum versions 2.1.x (before 2.1.8) and 3.0 alpha releases contain a flaw that allows forum members to circumvent attachment approval controls and access other members' uploads,…. A patch is available.

How to fix or mitigate CVE-2026-39903?

Within 24 hours: Identify all Simple Machines Forum installations running SMF 2.1 versions prior to 2.1.8 or SMF 3.0 alpha releases prior to 3.0 Alpha 5, and document exposure scope. Within 7 days: Upgrade to SMF 2.1.8 or later for 2.x series, or 3.0 Alpha 5 or later for 3.x series. Within 30 days: Audit attachment moderation logs for suspicious activity and verify proper access controls are enforced.

Simple Machines Forum CVE-2026-39903

Q: What is the CVSS score of CVE-2026-39903?

CVE-2026-39903 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42941 HIGH

Incorrect Authorization (CWE-863)

2026-07-10 VulnCheck

GHSA-62g6-4j9c-6v7p

PHP Authentication Bypass Smf Simplemachines

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network-reachable action needing only a low-priv authenticated account (PR:L) and no interaction; integrity high from unauthorized moderation, availability low from deletion, and C:L for enumeration of others' pending attachments.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 17:08 vuln.today

DescriptionCVE.org

Simple Machines Forum 2.1 prior to 2.1.8 and 3.0 prior to 3.0 Alpha 5 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve_posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments.

AnalysisAI

Authorization bypass in Simple Machines Forum (SMF) 2.1 before 2.1.8 and 3.0 before 3.0 Alpha 5 lets any authenticated low-privileged member manipulate the attachment moderation queue without the required approve_posts permission. A single-character operator mistake in Sources/Actions/AttachmentApprove.php makes the permission check evaluate to true for everyone, so an ordinary user can approve, reject, or delete pending attachments on any board and enumerate other users' unapproved uploads. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported by VulnCheck and a vendor patch is available.

Technical ContextAI

SMF is a widely used open-source PHP/MySQL bulletin-board application; the defect lives in its attachment-approval action handler (Sources/Actions/AttachmentApprove.php), which gates moderation actions behind the approve_posts board permission. The root cause is CWE-863 (Incorrect Authorization): a single-character operator error - the classic PHP mistake of using assignment or a wrong comparison/boolean operator instead of a strict check - causes the guard expression to always resolve truthy, so the permission gate passes unconditionally regardless of the caller's actual rights. Because the affected CPE is cpe:2.3:a:simplemachines:smf, the flaw is in the core forum code rather than a third-party mod, meaning every default install running the affected branches is exposed. The action operates over normal authenticated HTTP requests, so no special protocol or transport is involved beyond a logged-in session.

RemediationAI

Upgrade to the fixed releases: Simple Machines Forum 2.1.8 for the 2.1 branch and 3.0 Alpha 5 for the 3.0 branch (Vendor-released patch: 2.1.8 / 3.0 Alpha 5), applying the upstream changes in SMF pull requests 9181 and 9182 (commits 7d048f8 and a7875e8). If you cannot upgrade immediately, the practical compensating control is to restrict or disable the attachment moderation path for untrusted members - for example, turn off post/attachment moderation queues so no pending-approval workflow is exposed, or tighten board membership so that only trusted, already-vetted accounts can log in; note the trade-off that disabling moderation removes the pre-publication review of uploads, and restricting registration reduces community growth. Because exploitation requires an authenticated account, also review and prune low-trust or spam accounts to shrink the pool of potential attackers. Vendor advisory: https://www.vulncheck.com/advisories/simple-machines-forum-authorization-bypass-via-attachmentapprove-php.