Simple Machines Forum CVE-2026-43621

Exploitation requires an authenticated session with at minimum a low-privileged (regular member) account on the target SMF installation - the CVSS vector PR:L confirms unauthenticated access is not sufficient. The attack is triggered by supplying multiple values for the user parameter during profile loading, which is not standard browser behavior but is trivially achievable via crafted HTTP requests available to any authenticated user. On forums with open registration, the practical barrier is account creation only. The specific limiting factors are: (1) a valid forum account is required - anonymous visitors cannot exploit this; (2) the target must run SMF 2.1.7 or earlier without commit 6f0dc61 applied; (3) the attacker must know or enumerate a valid administrator member ID, which is often trivially discoverable through public profile pages. No non-default configuration, special plugin, or elevated platform access is required beyond a standard SMF installation.

The CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) is well-calibrated: network-accessible exploitation with low complexity, requiring only a low-privileged account and no user interaction accurately characterizes the attack surface. The high confidentiality and integrity impact to the vulnerable system reflects the full admin profile access - including password changes and unrestricted account management - that a successful exploit yields. No EPSS data is available in the provided intelligence, but the low attack complexity (AC:L, AT:N) and broad applicability to any authenticated session suggest non-trivial exploitation probability once attack specifics are widely known. No CISA KEV listing and no confirmed public POC code exist at time of analysis, meaning exploitation status is 'no public exploit identified at time of analysis.' On forums with open registration, the effective attack surface extends to any internet user capable of creating an account, which substantially lowers the real-world barrier beyond what PR:L alone conveys. The absence of an availability impact (VA:N) is consistent with the description, which focuses on account takeover rather than service disruption.

An attacker registers a low-privileged account on a publicly accessible SMF forum, then sends a crafted HTTP request to an SMF profile endpoint supplying multiple values for the user parameter - for example, referencing their own member ID followed by a target administrator's member ID. Profile::load() processes the multi-value input without strict identity binding, causing Profile::$member to resolve to the administrator's profile while the User::$me->is_owner check evaluates as true for the attacker's session. With effective ownership of the admin profile, the attacker submits a password-change request through the now-accessible account management interface, locks out the administrator, and gains unrestricted forum control.