NamelessMC CVE-2026-40314

Q: What is the CVSS score of CVE-2026-40314?

CVE-2026-40314 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33976 MEDIUM

Missing Authorization (CWE-862)

2026-06-02 GitHub_M

PHP Authentication Bypass

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:33 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

6.9 (MEDIUM)

DescriptionGitHub Advisory

NamelessMC is website software for Minecraft servers. In version 2.2.4,core/classes/Misc/ProfilePostReactionContext.php only verifies that the wall post exists and does not enforce blocked/private-profile visibility. modules/Core/queries/reactions.php allows unauthenticated GET requests for reaction details. This means that unauthenticated visitors can read reaction participants and timestamps for private profile posts and uthenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 fixes the issue.

AnalysisAI

Missing authorization controls in NamelessMC 2.2.4 expose private profile post reaction data to unauthenticated visitors and allow low-privileged authenticated users to interact with posts from profiles they are blocked by or that are set to private. Two distinct code paths are vulnerable: the reaction query endpoint in modules/Core/queries/reactions.php accepts unauthenticated GET requests without enforcing privacy settings, while core/classes/Misc/ProfilePostReactionContext.php only validates post existence rather than caller access rights. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog, but the unauthenticated read path requires no prerequisites against internet-facing installations.

Technical ContextAI

NamelessMC is a PHP-based content management system designed specifically for Minecraft server community websites, identified via CPE cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization): the application performs existence checks on resources (confirming a wall post is present) but omits the second layer of access control that enforces whether the requesting identity - authenticated or not - has permission to view or interact with that resource given its privacy classification. The ProfilePostReactionContext class is invoked without consulting the target profile's visibility settings (private, blocked), and the reactions.php query endpoint is exposed as a GET handler without a session or token requirement. This is a two-vector flaw: one path leaks metadata to unauthenticated callers, the other permits unsolicited write actions by authenticated low-privilege users against restricted profiles.

RemediationAI

Upgrade to NamelessMC version 2.2.5, which is confirmed by the vendor to resolve both the unauthenticated reaction query exposure and the missing profile-visibility enforcement in the reaction context class. The advisory is available at https://github.com/NamelessMC/Nameless/security/advisories/GHSA-55q9-8qm3-4grc. If immediate upgrade is not possible, a compensating control would be to restrict access to modules/Core/queries/reactions.php at the web server layer (e.g., require authentication via an nginx auth_basic directive or Apache Require valid-user) - note this may break legitimate reaction UI functionality for logged-in users. Alternatively, operators can temporarily disable the reactions feature within NamelessMC's admin panel to eliminate the attack surface entirely until the patch is applied, accepting the trade-off of lost engagement functionality.