NamelessMC EUVD-2026-33976

The unauthenticated read path requires no special conditions - any network-reachable visitor can query the reactions endpoint against default installations of NamelessMC 2.2.4 where at least one wall post exists; the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this. Exploitation is limited to reading reaction metadata (participant identities and timestamps) rather than post content. The authenticated integrity path requires a valid low-privileged user account on the NamelessMC instance and a target profile that has either set visibility to private or has blocked the authenticated user - both are non-default configurations chosen by end users, not admins. Neither attack path requires administrative access or any non-standard server configuration.

The CVSS 4.0 base score of 6.9 reflects a network-accessible (AV:N), low-complexity (AC:L), no-authentication (PR:N) vulnerability with low confidentiality (VC:L) and low integrity (VI:L) impact and no availability impact. The PR:N designation is consistent with the unauthenticated read path described in the advisory - any internet visitor can query reaction details on private posts. The authenticated write path is a separate, slightly higher-bar vector not independently scored. No EPSS data was provided in the intelligence feed; given the niche deployment footprint (Minecraft server community sites), widespread automated exploitation is unlikely. There is no KEV listing and no confirmed POC. The primary real-world risk is privacy erosion - attackers can map social graphs of private profile interactions - rather than system compromise. The low VI impact from the reaction-write path is real but operationally minor. Overall this is a genuine moderate-priority issue for any NamelessMC operator with a privacy-sensitive user base, but it does not represent an immediately critical threat to infrastructure.

An unauthenticated attacker sends a crafted GET request directly to the modules/Core/queries/reactions.php endpoint targeting a known or guessed post ID on a private profile. The endpoint returns reaction participant usernames and timestamps without checking the profile's privacy settings, allowing the attacker to enumerate social interactions on otherwise hidden posts. No public exploit code exists for this vulnerability at time of analysis.