PT-2026-45800 · Namelessmc · Nameless

Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-35443

Mitre

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

NamelessMC is website software for Minecraft servers. In version 2.2.4, modules/Forum/classes/ForumPostReactionContext.php only verifies that the caller can view the forum, but it does not re-enforce topic-level view other topics authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-35443

Affected Products

Nameless

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-35443 · Security Note
• https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64 · Note