Is CVE-2026-35443 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35443 being exploited in the wild.

How severe is CVE-2026-35443?

Informational severity, with a CVSS score of 5.3, published 2 June 2026.

Is there a fix for CVE-2026-35443?

A patch was published on 2026-06-02: Version 2.2.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35443 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35443?

Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35443: NamelessMC missing authorization for forum post reactions

CVE-2026-35443 · Severity: info · CVSS 5.3 · Published 2026-06-02

NamelessMC is a website software suite used to manage Minecraft server communities and forums. A security flaw in the forum module allows users to view and interact with reactions on private forum topics they are not authorized to see. This means a user who should only be able to see their own posts could potentially see who reacted to other users' private discussions or add their own reactions to those posts.

Technologies: NamelessMC. Vendors: NamelessMC.

Quick answers

Is CVE-2026-35443 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35443 being exploited in the wild.
How severe is CVE-2026-35443?: Informational severity, with a CVSS score of 5.3, published 2 June 2026.
Which products and versions are affected?: NamelessMC 2.2.4.
Is there a fix for CVE-2026-35443?: A patch was published on 2026-06-02: Version 2.2.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35443 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35443?: Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in NamelessMC version 2.2.4 within the `modules/Forum/classes/ForumPostReactionContext.php` component. While the software verifies that a user has general forum access, it fails to check the `view_other_topics` permission when processing reaction queries. An authenticated attacker with low-level privileges can exploit this by sending direct requests to the `/queries/reactions` endpoint. This allows the attacker to read reaction details and add new reactions to posts in topics they are otherwise restricted from viewing. The issue is resolved in version 2.2.5 by enforcing topic visibility checks within the reaction validation logic.

Affected products

NamelessMC NamelessMC 2.2.4

Timeline

2026-05-31: advisory: GitHub Security Advisory GHSA-wcrf-5gcp-pf64 published
2026-06-02: disclosed: CVE-2026-35443 published to NVD
2026-06-02: patched: Version 2.2.5 released to address the issue

References

https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.