PT-2026-45802 · Unknown · Namelessmc

Huajihd · CVE-2026-40314 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NamelessMC version 2.2.4

Description NamelessMC is website software for Minecraft servers. The software fails to enforce blocked or private profile visibility in core/classes/Misc/ProfilePostReactionContext.php, verifying only that the wall post exists. Additionally, the endpoint "modules/Core/queries/reactions.php" allows unauthenticated GET requests for reaction details. This allows unauthenticated visitors to read reaction participants and timestamps for private profile posts, and enables authenticated low-privileged users to add reactions to private or blocking profile posts.

Recommendations Update to version 2.2.5.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-40314

GHSA-55Q9-8QM3-4GRC

Affected Products

Namelessmc

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40314.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-55q9-8qm3-4grc · Exploit
• https://osv.dev/vulnerability/CVE-2026-40314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40314 · Security Note
• https://t.me/CVEtracker/55638 · Telegram Post