# CVE-2026-40314: NamelessMC missing authorization for private profile post reactions

Source: https://junglewise.ai/threats/cve-2026-40314-namelessmc-missing-authorization-for-private-profile-post  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-40314 · Severity: info · CVSS 6.9 · Published 2026-06-02

NamelessMC is a popular website software used by Minecraft server communities to manage forums and user profiles. A security flaw allows unauthorized visitors to view interaction details, such as who reacted to a post and when, even if that post is on a private or blocked profile. Additionally, low-privileged users can add reactions to posts they should not be able to see, potentially leading to harassment or unauthorized data discovery.

Technologies: [NamelessMC](https://junglewise.ai/threats/technologies/namelessmc). Vendors: [NamelessMC](https://junglewise.ai/threats/vendors/namelessmc).

## Quick answers

**Is CVE-2026-40314 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40314 being exploited in the wild.

**How severe is CVE-2026-40314?** Informational severity, with a CVSS score of 6.9, published 2 June 2026.

**Which products and versions are affected?** NamelessMC 2.2.4.

**Is there a fix for CVE-2026-40314?** A patch was published on 2026-06-02: Version 2.2.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40314 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-40314?** Check whether you run NamelessMC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability exists in NamelessMC version 2.2.4 within the ProfilePostReactionContext.php and reactions.php components. The software fails to enforce visibility restrictions for private or blocked profiles when processing reaction queries. Specifically, the 'core/classes/Misc/ProfilePostReactionContext.php' file only validates the existence of a post rather than user permissions, and 'modules/Core/queries/reactions.php' permits unauthenticated GET requests. This allows an attacker to leak reaction participants and timestamps via direct API queries or add reactions to restricted posts. The issue is resolved in version 2.2.5 by enforcing proper authorization checks.

## Affected products

- NamelessMC NamelessMC 2.2.4

## Timeline

- 2026-05-31: advisory: GitHub Security Advisory published by vendor
- 2026-06-02: disclosed: CVE published to NVD
- 2026-06-02: patched: Version 2.2.5 released to address the issue

## References

- [https://github.com/NamelessMC/Nameless/security/advisories/GHSA-55q9-8qm3-4grc](https://github.com/NamelessMC/Nameless/security/advisories/GHSA-55q9-8qm3-4grc)

## Related threats

- [NamelessMC missing authorization for reactions on private profile posts](https://junglewise.ai/threats/cve-2026-40571-namelessmc-missing-authorization-for-reactions-on-private-profile)
- [NamelessMC authorization bypass in profile wall posts](https://junglewise.ai/threats/cve-2026-35447-namelessmc-authorization-bypass-in-profile-wall-posts)
- [NamelessMC missing authorization for forum post reactions](https://junglewise.ai/threats/cve-2026-35443-namelessmc-missing-authorization-for-forum-post-reactions)
- [NamelessMC OAuth login CSRF in callback handling](https://junglewise.ai/threats/cve-2026-34460-namelessmc-oauth-login-csrf-in-callback-handling)
- [NamelessMC improper authorization in forum get_quotes endpoint](https://junglewise.ai/threats/cve-2026-33398-namelessmc-improper-authorization-in-forum-get-quotes-endpoint)