CVE-2026-33398

Name of the Vulnerable Software and Affected Versions NamelessMC version 2.2.4

Description An issue exists where the endpoint modules/Forum/pages/forum/get quotes.php only verifies if a user is logged in before retrieving a post based on the post variable. The backend helper in modules/Forum/classes/Forum.php fails to enforce Access Control Lists (ACLs)—which are sets of rules that define permissions for users or systems—for forums or topics. This allows authenticated users with low privileges to enumerate post IDs and access content from private, hidden, or staff-only forums, bypassing the visibility restrictions enforced in modules/Forum/pages/forum/view topic.php.

Recommendations Update NamelessMC to version 2.2.5.