PT-2026-57216 · Simple Machines · Smf

Elure + 1 · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-39903

Mitre

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Simple Machines Forum 2.1 prior to 2.1.8 and 3.0 prior to 3.0 Alpha 5 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-39903

Produtos afetados

Smf

Referências · 6

• https://github.com/SimpleMachines/SMF/commit/7d048f8d66aab9af51cd6ee110fbad103cf673e8 · Correção
• https://github.com/SimpleMachines/SMF/pull/9182 · Nota
• https://github.com/SimpleMachines/SMF/commit/a7875e876a647572dd4c45da881b875092caac3d · Correção
• https://github.com/SimpleMachines/SMF/pull/9181 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-39903 · Nota de Segurança
• https://vulncheck.com/advisories/simple-machines-forum-authorization-bypass-via-attachmentapprove-php · Nota