Quick answers
- Is CVE-2026-35447 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35447 being exploited in the wild.
- How severe is CVE-2026-35447?
- Informational severity, with a CVSS score of 5.3, published 2 June 2026.
- Which products and versions are affected?
- NamelessMC 2.2.4.
- Is there a fix for CVE-2026-35447?
- A patch was published on 2026-06-02: Patch released in version 2.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-35447 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-35447?
- Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
In NamelessMC version 2.2.4, the profile page (modules/Core/pages/profile.php) processes 'new_post' and 'reply' actions before verifying the 'CAN_VIEW' authorization status. This logic flaw allows any authenticated user with 'profile.post' permissions to submit wall posts to profiles that are otherwise restricted (private or blocking). Furthermore, the reply mechanism fails to validate that a target wall post ID actually belongs to the profile being viewed, enabling cross-profile reply injection. Attackers can exploit this by sending direct POST requests to a restricted profile URL with a target post ID belonging to a different user. The issue is resolved in version 2.2.5 by centralizing authorization checks.
Affected products
- NamelessMC NamelessMC 2.2.4
Timeline
- 2026-05-31: advisory: GitHub Security Advisory published by vendor
- 2026-06-02: disclosed: CVE published to NVD
- 2026-06-02: patched: Patch released in version 2.2.5