# CVE-2026-33398: NamelessMC improper authorization in forum get_quotes endpoint

Source: https://junglewise.ai/threats/cve-2026-33398-namelessmc-improper-authorization-in-forum-get-quotes-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-33398 · Severity: info · CVSS 7.1 · Published 2026-06-02

NamelessMC is a popular website software used by Minecraft server communities to manage forums and user accounts. A security flaw allows any logged-in user to bypass privacy settings and read messages in restricted areas, such as private staff-only forums. This could lead to the exposure of sensitive administrative discussions or private member data.

Technologies: [NamelessMC](https://junglewise.ai/threats/technologies/namelessmc). Vendors: [NamelessMC](https://junglewise.ai/threats/vendors/namelessmc).

## Quick answers

**Is CVE-2026-33398 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33398 being exploited in the wild.

**How severe is CVE-2026-33398?** Informational severity, with a CVSS score of 7.1, published 2 June 2026.

**Which products and versions are affected?** NamelessMC 2.2.4.

**Is there a fix for CVE-2026-33398?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33398 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-33398?** Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability (CWE-285) exists in the `get_quotes.php` module of NamelessMC version 2.2.4. While the standard topic view enforces Access Control Lists (ACLs), the `get_quotes` endpoint only verifies that a user is logged in before fetching post content via an attacker-supplied `post` ID. Because the backend helper in `Forum.php` fails to validate forum or topic-level permissions, a low-privileged user can enumerate post IDs to leak content and author metadata from restricted, hidden, or staff-only forums. This issue is resolved in version 2.2.5.

## Affected products

- NamelessMC NamelessMC 2.2.4

## Timeline

- 2026-05-31: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE published to NVD

## References

- [https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx](https://github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx)

## Related threats

- [NamelessMC missing authorization for reactions on private profile posts](https://junglewise.ai/threats/cve-2026-40571-namelessmc-missing-authorization-for-reactions-on-private-profile)
- [NamelessMC missing authorization for private profile post reactions](https://junglewise.ai/threats/cve-2026-40314-namelessmc-missing-authorization-for-private-profile-post)
- [NamelessMC authorization bypass in profile wall posts](https://junglewise.ai/threats/cve-2026-35447-namelessmc-authorization-bypass-in-profile-wall-posts)
- [NamelessMC missing authorization for forum post reactions](https://junglewise.ai/threats/cve-2026-35443-namelessmc-missing-authorization-for-forum-post-reactions)
- [NamelessMC OAuth login CSRF in callback handling](https://junglewise.ai/threats/cve-2026-34460-namelessmc-oauth-login-csrf-in-callback-handling)