Executive brief
Simple Machines Forum (SMF) is a widely-used open-source discussion board platform. A vulnerability in its user profile loading mechanism allows low-privileged authenticated users to gain full administrator access by manipulating request parameters. An attacker with a basic user account can take over administrator accounts, change passwords, and gain complete control of the forum, affecting all data and operations.
Technical details
The vulnerability is an authorization state-confusion flaw (CWE-863) in SMF's Profile::load() function that processes the user parameter. When an attacker supplies multiple conflicting values for the user parameter during sequential profile loads, a mismatch occurs between the Profile::$member variable and the User::$me->is_owner check. This mismatch causes the application to incorrectly treat the attacker as the owner of an administrator profile. The vulnerability requires authentication (low-privilege account) and network access, allowing the attacker to bypass authorization checks and perform unauthorized password changes and account takeover. The fix was implemented in commit 6f0dc61 by replacing Profile::load(0) with Profile::loadMember(0) to properly validate profile ownership.
Affected products
- Simple Machines Simple Machines Forum through 2.1.7
Timeline
- 2026-08-26: disclosed
- 2026-07-15: patched: Fix committed on this date (commit 6f0dc61)