PT-2026-45800

CVE-2026-35443

Published

2026-06-02

Updated

2026-06-02

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions NamelessMC version 2.2.4

Description In the modules/Forum/classes/ForumPostReactionContext.php file, the software verifies if a caller can view the forum but fails to enforce the topic-level view other topics authorization. This allows users who are restricted to viewing only their own topics to read and modify reactions on topics belonging to other users.

Recommendations Update to version 2.2.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Huajihd

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers