CVE-2026-35443mediumCWE-862

CVE-2026-35443: falha de média gravidade em NamelessMC Nameless

NamelessMC: Forum reactions bypass the "view own topics only" restriction

Publicada em

Seguir esta CVE+ Monitorar Nameless

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` authorization. As a result, in forums where users may enter the forum but may only view their own topics, reactions can still be read and modified on other users' topics. Version 2.2.5 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
NamelessMC · Nameless
CVEs relacionadas — NamelessMC Nameless

No mesmo produto, das mais perigosas para as menos.

CVE-2025-22144CRITICALAccount Takeover in NamelessMCEPSS 0.8%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2025-31118HIGHNamelessMC Has Forum Reply Submission Time Limit BypassEPSS 0.6%CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.6%CVE-2025-32389HIGHNamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports PagesEPSS 0.5%CVE-2025-31120MEDIUMNamelessMC Vulnerable to Cookie-Based View Count ManipulationEPSS 0.5%