CVE-2025-30357: NamelessMC Information Disclosure Flaw

CVE-2025-30357 Overview

CVE-2025-30357 affects NamelessMC, a free website software widely used by Minecraft server operators. The vulnerability exists in versions 2.1.4 and prior, where administrator account deletion actions cascade incorrectly across forum data. When an administrator deletes a spam account, all posts made by that user are marked as deleted, along with any topics those posts touched. This includes topics authored by unrelated users, resulting in unintended destruction of legitimate community content. The maintainers patched the flaw in version 2.2.0. The issue is categorized under CWE-706: Use of Incorrectly-Resolved Name or Reference due to improper foreign key cascade behavior in the forum database schema.

Critical Impact
A privileged administrator action intended to remove a single malicious user can destroy forum topics belonging to unrelated legitimate users, causing integrity loss across community content.

Affected Products

NamelessMC Nameless versions up to and including 2.1.4
NamelessMC installations exposing forum and comment functionality
Deployments running the nl2_topics schema without the v2.2.0 migration

Discovery Timeline

2025-04-18 - CVE-2025-30357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30357

Vulnerability Analysis

The flaw resides in the forum data model used by NamelessMC. The nl2_topics table tracks the last user who posted in a topic through the topic_last_user foreign key column. In vulnerable versions, this foreign key relationship propagates deletion state to associated topics when the referenced user record is removed. Administrators moderating spam frequently choose account deletion as a bulk remediation path. That action then marks unrelated topics as deleted, causing loss of legitimate community discussions. The vulnerability requires high privileges but no user interaction, and the scope changes because the impact extends beyond content owned by the deleted account.

Root Cause

The root cause is an incorrect foreign key cascade configuration on the topic_last_user column of nl2_topics. The original schema tied topic lifecycle to the last poster's user record rather than nullifying that reference on user removal. When the referenced user was deleted, the cascade rule marked the topic as deleted regardless of the original topic author.

Attack Vector

A malicious actor with the ability to post comments floods multiple topics authored by other users with spam. When an administrator later removes the spam account as a cleanup measure, the improper cascade destroys unrelated topics touched by that account. Exploitation weaponizes a normal moderation workflow to achieve indirect data destruction. The attacker does not need administrator access, only standard commenting privileges.

php

<?php
declare(strict_types=1);

use Phinx\Migration\AbstractMigration;

final class UpdateForumTopicKeyCascades extends AbstractMigration
{
    public function change(): void
    {
        $table = $this->table('nl2_topics');
        $table->dropForeignKey('topic_last_user');

        $table->changeColumn('topic_last_user', 'integer', ['length' => 11, 'null' => true, 'default' => null]);
        $table->addForeignKey('topic_last_user', 'nl2_users', 'id', ['delete' => 'SET_NULL', 'update' => 'CASCADE']);
        $table->update();
    }
}

Source: NamelessMC patch commit 7040924. The patch drops the existing foreign key on topic_last_user, makes the column nullable, and re-adds the constraint with SET_NULL on delete. This ensures user deletion nullifies the reference instead of propagating a delete state to unrelated topics.

Detection Methods for CVE-2025-30357

Indicators of Compromise

Sudden bulk marking of forum topics as deleted immediately following an administrator account removal action
Multiple accounts posting near-identical comment content across unrelated topics prior to a moderation event
Loss of topic content authored by users other than the deleted account

Detection Strategies

Audit the NamelessMC admin action log for account deletions correlated with mass topic deletions in nl2_topics
Query the database for topics with a deleted flag whose original author differs from the recently removed user
Track spam comment patterns across topics to identify pre-positioning behavior consistent with this abuse chain

Monitoring Recommendations

Alert on administrator-triggered user deletion events that coincide with topic status changes exceeding a defined threshold
Log and review all changes to the nl2_topics table, including cascade-driven updates
Retain forum database backups on a rolling schedule to enable rapid rollback if content loss is detected

How to Mitigate CVE-2025-30357

Immediate Actions Required

Upgrade NamelessMC to version 2.2.0 or later to apply the corrected foreign key cascade
Before upgrading, take a full database backup of the NamelessMC schema, including nl2_topics and nl2_users
Instruct administrators to avoid deleting user accounts on vulnerable versions; use account suspension or ban functionality instead

Patch Information

The fix is included in the NamelessMC v2.2.0 release. The migration 20250319185504_update_forum_topic_key_cascades.php replaces the destructive cascade with a SET_NULL behavior on the topic_last_user foreign key. Full technical details are available in the GitHub Security Advisory GHSA-22mc-7c9m-gv8h.

Workarounds

Restrict administrator deletion privileges to a minimal set of trusted staff until the patch is deployed
Use account suspension, ban, or role demotion in place of hard account deletion when moderating spam
Manually delete individual spam comments through the moderation interface rather than removing the parent account

bash

# Upgrade NamelessMC to a patched release
git fetch --tags
git checkout v2.2.0
php core/includes/phinx/vendor/bin/phinx migrate -c core/includes/phinx/phinx.php