# CVE-2026-35443: NamelessMC missing authorization for forum post reactions

Source: https://junglewise.ai/threats/cve-2026-35443-namelessmc-missing-authorization-for-forum-post-reactions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-35443 · Severity: info · CVSS 5.3 · Published 2026-06-02

NamelessMC is a website software suite used to manage Minecraft server communities and forums. A security flaw in the forum module allows users to view and interact with reactions on private forum topics they are not authorized to see. This means a user who should only be able to see their own posts could potentially see who reacted to other users' private discussions or add their own reactions to those posts.

Technologies: [NamelessMC](https://junglewise.ai/threats/technologies/namelessmc). Vendors: [NamelessMC](https://junglewise.ai/threats/vendors/namelessmc).

## Quick answers

**Is CVE-2026-35443 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35443 being exploited in the wild.

**How severe is CVE-2026-35443?** Informational severity, with a CVSS score of 5.3, published 2 June 2026.

**Which products and versions are affected?** NamelessMC 2.2.4.

**Is there a fix for CVE-2026-35443?** A patch was published on 2026-06-02: Version 2.2.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35443 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35443?** Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in NamelessMC version 2.2.4 within the `modules/Forum/classes/ForumPostReactionContext.php` component. While the software verifies that a user has general forum access, it fails to check the `view_other_topics` permission when processing reaction queries. An authenticated attacker with low-level privileges can exploit this by sending direct requests to the `/queries/reactions` endpoint. This allows the attacker to read reaction details and add new reactions to posts in topics they are otherwise restricted from viewing. The issue is resolved in version 2.2.5 by enforcing topic visibility checks within the reaction validation logic.

## Affected products

- NamelessMC NamelessMC 2.2.4

## Timeline

- 2026-05-31: advisory: GitHub Security Advisory GHSA-wcrf-5gcp-pf64 published
- 2026-06-02: disclosed: CVE-2026-35443 published to NVD
- 2026-06-02: patched: Version 2.2.5 released to address the issue

## References

- [https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64](https://github.com/NamelessMC/Nameless/security/advisories/GHSA-wcrf-5gcp-pf64)

## Related threats

- [NamelessMC missing authorization for reactions on private profile posts](https://junglewise.ai/threats/cve-2026-40571-namelessmc-missing-authorization-for-reactions-on-private-profile)
- [NamelessMC missing authorization for private profile post reactions](https://junglewise.ai/threats/cve-2026-40314-namelessmc-missing-authorization-for-private-profile-post)
- [NamelessMC authorization bypass in profile wall posts](https://junglewise.ai/threats/cve-2026-35447-namelessmc-authorization-bypass-in-profile-wall-posts)
- [NamelessMC OAuth login CSRF in callback handling](https://junglewise.ai/threats/cve-2026-34460-namelessmc-oauth-login-csrf-in-callback-handling)
- [NamelessMC improper authorization in forum get_quotes endpoint](https://junglewise.ai/threats/cve-2026-33398-namelessmc-improper-authorization-in-forum-get-quotes-endpoint)