PT-2026-45773 · Unknown · Namelessmc

Huajihd · CVE-2026-33398 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NamelessMC version 2.2.4

Description An issue exists where the endpoint modules/Forum/pages/forum/get quotes.php only verifies if a user is logged in before retrieving a post based on the post variable. The backend helper in modules/Forum/classes/Forum.php fails to enforce Access Control Lists (ACLs)—which are sets of rules that define permissions for users or systems—for forums or topics. This allows authenticated users with low privileges to enumerate post IDs and access content from private, hidden, or staff-only forums, bypassing the visibility restrictions enforced in modules/Forum/pages/forum/view topic.php.

Recommendations Update NamelessMC to version 2.2.5.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-33398

GHSA-2R6X-CV4F-H8FX

Affected Products

Namelessmc

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33398.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx · Exploit
• https://osv.dev/vulnerability/CVE-2026-33398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33398 · Security Note