Executive brief
NamelessMC is a popular website platform used by Minecraft server owners to manage their communities. A security flaw in the profile management system allows users to bypass privacy settings and post messages on profiles that are set to private or have blocked them. Additionally, attackers can inject replies into message threads on other users' profiles, potentially leading to harassment or the spread of unauthorized content.
Technical details
In NamelessMC version 2.2.4, the profile page (modules/Core/pages/profile.php) processes 'new_post' and 'reply' actions before verifying the 'CAN_VIEW' authorization status. This logic flaw allows any authenticated user with 'profile.post' permissions to submit wall posts to profiles that are otherwise restricted (private or blocking). Furthermore, the reply mechanism fails to validate that a target wall post ID actually belongs to the profile being viewed, enabling cross-profile reply injection. Attackers can exploit this by sending direct POST requests to a restricted profile URL with a target post ID belonging to a different user. The issue is resolved in version 2.2.5 by centralizing authorization checks.
Affected products
- NamelessMC NamelessMC 2.2.4
Timeline
- 2026-05-31: advisory: GitHub Security Advisory published by vendor
- 2026-06-02: disclosed: CVE published to NVD
- 2026-06-02: patched: Patch released in version 2.2.5