PT-2026-57216 · Simple Machines · Smf

Elure + 1 · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-39903

Mitre

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Simple Machines Forum 2.1 prior to 2.1.8 and 3.0 prior to 3.0 Alpha 5 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-39903

Affected Products

Smf

References · 6

• https://github.com/SimpleMachines/SMF/commit/7d048f8d66aab9af51cd6ee110fbad103cf673e8 · Patch
• https://github.com/SimpleMachines/SMF/commit/a7875e876a647572dd4c45da881b875092caac3d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39903 · Security Note
• https://github.com/SimpleMachines/SMF/pull/9182 · Note
• https://github.com/SimpleMachines/SMF/pull/9181 · Note
• https://vulncheck.com/advisories/simple-machines-forum-authorization-bypass-via-attachmentapprove-php · Note