NamelessMC CVE-2026-40571

Exploitation requires a valid authenticated session with low-privileged (standard registered member) access on a NamelessMC 2.2.4 instance - the CVSS vector PR:L confirms authentication is mandatory. The target must be a profile wall post belonging to either a user who has blocked the attacker or a profile configured with private visibility. No special configuration beyond default NamelessMC deployment is required for the vulnerable code path to be reachable. What limits exploitation: the attacker must be a registered, authenticated user; the privacy bypass only affects reactions specifically (not reads of post content); and the impact is constrained to low confidentiality and integrity effects on the vulnerable system with no lateral scope impact (SC:N/SI:N).

The CVSS 4.0 base score of 5.3 reflects a moderate severity with network attack vector (AV:N), low complexity (AC:L), low privilege requirement (PR:L), and no user interaction (UI:N), resulting in limited confidentiality and integrity impact (VC:L/VI:L) with no availability impact. Real-world risk is relatively low: the attacker must already be an authenticated user on the platform, limiting the exposed population to registered members. The impact is a privacy control bypass - attackers can signal their presence (via reactions) to users who explicitly blocked them or set profiles to private, which is a social/privacy harm rather than a data breach or system compromise. No KEV listing and no public exploit code identified at time of analysis, reinforcing that this is not an opportunistic mass-exploitation target. EPSS data was not provided; given the niche deployment context (Minecraft community sites) and the authentication prerequisite, real-world exploitation probability is assessed as low. The primary concern is for platforms where user blocking and privacy carry meaningful safety or trust implications.

An authenticated registered user on a NamelessMC 2.2.4 site - for example, an account that has been blocked by another user - crafts a direct reaction request targeting a wall post on the blocking user's private or restricted profile. Because ProfilePostReactionContext.php only confirms the post exists without validating profile visibility or block status, the reaction is recorded successfully, allowing the blocked user to interact with content they should be excluded from and revealing their activity to the profile owner.