NamelessMC CVE-2026-40571

Q: What is the CVSS score of CVE-2026-40571?

CVE-2026-40571 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33983 MEDIUM

Missing Authorization (CWE-862)

2026-06-02 GitHub_M

PHP Authentication Bypass

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:34 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

5.3 (MEDIUM)

DescriptionGitHub Advisory

NamelessMC is website software for Minecraft servers. In version 2.2.4, core/classes/Misc/ProfilePostReactionContext.php only verifies that the wall post exists and does not enforce blocked/private-profile visibility. This means that authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.

AnalysisAI

Missing authorization in NamelessMC 2.2.4 allows authenticated low-privileged users to add reactions to wall posts on private profiles or profiles that have blocked them, bypassing expected privacy and blocking controls. The flaw exists in core/classes/Misc/ProfilePostReactionContext.php, which validates only that the target post exists but performs no check against the profile's visibility settings or block relationships. No public exploit identified at time of analysis, and the vendor has released a patch in version 2.2.5.

Technical ContextAI

NamelessMC is open-source PHP-based website software designed for Minecraft server communities, providing profile walls, reactions, and social features. The affected component, core/classes/Misc/ProfilePostReactionContext.php, handles the authorization context for profile post reactions. Per CWE-862 (Missing Authorization), the code path resolves whether the target post exists but omits the secondary authorization gate that would enforce profile privacy settings (private profiles) and user-to-user block relationships. This represents an incomplete access control implementation - authentication is enforced (PR:L), but post-authentication visibility rules are not re-evaluated at the reaction endpoint. The CPE cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* indicates all tracked NamelessMC versions prior to the fix are in scope.

RemediationAI

Upgrade NamelessMC to version 2.2.5, which contains the vendor-released patch addressing this missing authorization check. The fix is documented in the GitHub Security Advisory at https://github.com/NamelessMC/Nameless/security/advisories/GHSA-47hr-jj6c-rqf9. If an immediate upgrade is not feasible, a compensating control would be to disable profile reactions site-wide through NamelessMC's administrative settings, which eliminates the vulnerable code path entirely but removes reaction functionality for all users. Alternatively, administrators can restrict registration or enforce moderation of new accounts to limit the pool of authenticated low-privileged users who could abuse the bypass, though this does not address the root cause and carries usability trade-offs.