CVE-2026-40571 MEDIUM

CVE-2026-40571: NamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization

Vendor Namelessmc
Product Nameless
Weakness CWE-862 · Missing authorization
Published June 2, 2026
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. This means that authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.

Key dates

02Disclosure timeline

June 2, 2026 CVE published
June 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-66154 WordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerability CVE-2023-41865 WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability CVE-2024-6120 Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import CVE-2024-3609 ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization CVE-2025-30934 WordPress 診断ジェネレータ作成プラグイン plugin <= 1.4.16 - Broken Access Control Vulnerability