Executive brief
NamelessMC is a popular website software used by Minecraft server communities to manage forums and user profiles. A security flaw allows unauthorized visitors to view interaction details, such as who reacted to a post and when, even if that post is on a private or blocked profile. Additionally, low-privileged users can add reactions to posts they should not be able to see, potentially leading to harassment or unauthorized data discovery.
Technical details
A missing authorization vulnerability exists in NamelessMC version 2.2.4 within the ProfilePostReactionContext.php and reactions.php components. The software fails to enforce visibility restrictions for private or blocked profiles when processing reaction queries. Specifically, the 'core/classes/Misc/ProfilePostReactionContext.php' file only validates the existence of a post rather than user permissions, and 'modules/Core/queries/reactions.php' permits unauthenticated GET requests. This allows an attacker to leak reaction participants and timestamps via direct API queries or add reactions to restricted posts. The issue is resolved in version 2.2.5 by enforcing proper authorization checks.
Affected products
- NamelessMC NamelessMC 2.2.4
Timeline
- 2026-05-31: advisory: GitHub Security Advisory published by vendor
- 2026-06-02: disclosed: CVE published to NVD
- 2026-06-02: patched: Version 2.2.5 released to address the issue