CVE-2026-43621

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions prior to 2.1.7

Description An authorization state-confusion issue exists in the profile loader. Authenticated low-privileged users can obtain administrator access by providing multiple values for the user parameter. This occurs due to a mismatch between Profile::$member and User::$me->is owner during sequential profile loading, which allows an attacker to be recognized as the owner of an administrator profile, leading to unauthorized password changes and full account takeover.

Recommendations Update Simple Machines Forum (SMF) to a version that includes commit 6f0dc61.