# CVE-2026-35447: NamelessMC authorization bypass in profile wall posts

Source: https://junglewise.ai/threats/cve-2026-35447-namelessmc-authorization-bypass-in-profile-wall-posts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-35447 · Severity: info · CVSS 5.3 · Published 2026-06-02

NamelessMC is a popular website platform used by Minecraft server owners to manage their communities. A security flaw in the profile management system allows users to bypass privacy settings and post messages on profiles that are set to private or have blocked them. Additionally, attackers can inject replies into message threads on other users' profiles, potentially leading to harassment or the spread of unauthorized content.

Technologies: [NamelessMC](https://junglewise.ai/threats/technologies/namelessmc). Vendors: [NamelessMC](https://junglewise.ai/threats/vendors/namelessmc).

## Quick answers

**Is CVE-2026-35447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35447 being exploited in the wild.

**How severe is CVE-2026-35447?** Informational severity, with a CVSS score of 5.3, published 2 June 2026.

**Which products and versions are affected?** NamelessMC 2.2.4.

**Is there a fix for CVE-2026-35447?** A patch was published on 2026-06-02: Patch released in version 2.2.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35447 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-35447?** Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

In NamelessMC version 2.2.4, the profile page (modules/Core/pages/profile.php) processes 'new_post' and 'reply' actions before verifying the 'CAN_VIEW' authorization status. This logic flaw allows any authenticated user with 'profile.post' permissions to submit wall posts to profiles that are otherwise restricted (private or blocking). Furthermore, the reply mechanism fails to validate that a target wall post ID actually belongs to the profile being viewed, enabling cross-profile reply injection. Attackers can exploit this by sending direct POST requests to a restricted profile URL with a target post ID belonging to a different user. The issue is resolved in version 2.2.5 by centralizing authorization checks.

## Affected products

- NamelessMC NamelessMC 2.2.4

## Timeline

- 2026-05-31: advisory: GitHub Security Advisory published by vendor
- 2026-06-02: disclosed: CVE published to NVD
- 2026-06-02: patched: Patch released in version 2.2.5

## References

- [https://github.com/NamelessMC/Nameless/security/advisories/GHSA-c9xj-rxgw-g2hq](https://github.com/NamelessMC/Nameless/security/advisories/GHSA-c9xj-rxgw-g2hq)

## Related threats

- [NamelessMC missing authorization for reactions on private profile posts](https://junglewise.ai/threats/cve-2026-40571-namelessmc-missing-authorization-for-reactions-on-private-profile)
- [NamelessMC missing authorization for private profile post reactions](https://junglewise.ai/threats/cve-2026-40314-namelessmc-missing-authorization-for-private-profile-post)
- [NamelessMC missing authorization for forum post reactions](https://junglewise.ai/threats/cve-2026-35443-namelessmc-missing-authorization-for-forum-post-reactions)
- [NamelessMC OAuth login CSRF in callback handling](https://junglewise.ai/threats/cve-2026-34460-namelessmc-oauth-login-csrf-in-callback-handling)
- [NamelessMC improper authorization in forum get_quotes endpoint](https://junglewise.ai/threats/cve-2026-33398-namelessmc-improper-authorization-in-forum-get-quotes-endpoint)