PT-2026-45802

CVE-2026-40314

Published

2026-06-02

Updated

2026-06-02

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NamelessMC version 2.2.4

Description NamelessMC is website software for Minecraft servers. The software fails to enforce blocked or private profile visibility in core/classes/Misc/ProfilePostReactionContext.php, verifying only that the wall post exists. Additionally, the endpoint "modules/Core/queries/reactions.php" allows unauthenticated GET requests for reaction details. This allows unauthenticated visitors to read reaction participants and timestamps for private profile posts, and enables authenticated low-privileged users to add reactions to private or blocking profile posts.

Recommendations Update to version 2.2.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Huajihd

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers