CVE-2026-40314 NamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization

NamelessMC is website software for Minecraft servers. In version 2.2.4,core/classes/Misc/ProfilePostReactionContext.php only verifies that the wall post exists and does not enforce blocked/private-profile visibility. modules/Core/queries/reactions.php allows unauthenticated GET requests for...

CVE-2026-35443

NamelessMC is website software for Minecraft servers. In version 2.2.4, "modules/Forum/classes/ForumPostReactionContext.php" only verifies that the caller can view the forum, but it does not re-enforce topic-level "viewothertopics" authorization. As a result, in forums where users may enter the...