Abdullah0X1337

**Name of the Vulnerable Software and Affected Versions** Simple Machines Forum (SMF) versions prior to 2.1.7 **Description** An authorization state-confusion issue exists in the profile loader. Authenticated low-privileged users can obtain administrator access by providing multiple values for the `user` parameter. This occurs due to a mismatch between `Profile::$member` and `User::$me->is owner` during sequential profile loading, which allows an attacker to be recognized as the owner of an administrator profile, leading to unauthorized password changes and full account takeover. **Recommendations** Update Simple Machines Forum (SMF) to a version that includes commit 6f0dc61.