CVE-2026-33398

🗓️ 02 Jun 2026 15:19:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Authenticated users can read hidden posts via get_quotes due to missing access checks; fixed in two point two five.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-33398	2 Jun 202615:19	–	attackerkb
CNNVD	NamelessMC 安全漏洞	2 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-33398 Authenticated users can read hidden forum posts through `/forum/get_quotes`	2 Jun 202615:19	–	cvelist
EUVD	EUVD-2026-33949	2 Jun 202615:19	–	euvd
NVD	CVE-2026-33398	2 Jun 202616:16	–	nvd
Positive Technologies	PT-2026-45773	2 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-33398	5 Jun 202619:17	–	redhatcve
Vulnrichment	CVE-2026-33398 Authenticated users can read hidden forum posts through `/forum/get_quotes`	2 Jun 202615:19	–	vulnrichment

Vulners

Node

namelessmc nameless

[
  {
    "vendor": "NamelessMC",
    "product": "Nameless",
    "versions": [
      {
        "version": "= 2.2.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/NamelessMC/Nameless/security/advisories/GHSA-2r6x-cv4f-h8fx

Parameter	Position	Path	Description	CWE
post	query param	modules/Forum/pages/forum/get_quotes.php	Authenticated users can read content of posts from hidden/private/staff-only forums by supplying an attacker-controlled post ID, due to insufficient ACL enforcement in the backend (no proper topic/forum ACL checks).	CWE-285

17 Jun 2026 10:37Current

5.8Medium risk

Vulners AI Score5.8

CVSS 47.1

EPSS0.00225

SSVC

CWE-285