CVE-2026-40571mediumCWE-862

CVE-2026-40571: falha de média gravidade em NamelessMC Nameless

NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Nameless

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. This means that authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
NamelessMC · Nameless
CVEs relacionadas — NamelessMC Nameless

No mesmo produto, das mais perigosas para as menos.

CVE-2025-22144CRITICALAccount Takeover in NamelessMCEPSS 0.8%CVE-2025-29784HIGHNamelessMC Has Lack of Length Validation for s Parameter in GET RequestsEPSS 0.7%CVE-2025-31118HIGHNamelessMC Has Forum Reply Submission Time Limit BypassEPSS 0.6%CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.6%CVE-2025-32389HIGHNamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports PagesEPSS 0.5%CVE-2025-31120MEDIUMNamelessMC Vulnerable to Cookie-Based View Count ManipulationEPSS 0.5%