CVE-2026-33398: NamelessMC Information Disclosure Flaw

CVE-2026-33398 Overview

CVE-2026-33398 is an authorization bypass vulnerability in NamelessMC, website software for Minecraft servers. The flaw exists in version 2.2.4 within modules/Forum/pages/forum/get_quotes.php, which only verifies that the caller is authenticated before returning post content referenced by an attacker-controlled post ID. The backend helper in modules/Forum/classes/Forum.php does not enforce forum or topic access control lists (ACLs). Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums. The issue is tracked under [CWE-285] (Improper Authorization) and resolved in version 2.2.5.

Critical Impact

Authenticated users with minimal privileges can read confidential staff and private forum posts by iterating post IDs against the quote endpoint.

Affected Products

• NamelessMC version 2.2.4
• NamelessMC Forum module (modules/Forum)
• Self-hosted Minecraft community sites running affected versions

Discovery Timeline

• 2026-06-02 - CVE-2026-33398 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-33398

Vulnerability Analysis

The vulnerability resides in the forum quote retrieval endpoint, which is intended to populate quoted post content during reply composition. The endpoint at modules/Forum/pages/forum/get_quotes.php performs a single authorization check confirming that the requester is logged in. It then accepts a user-supplied post parameter and returns the corresponding post body. The normal topic rendering path in modules/Forum/pages/forum/view_topic.php enforces both forum visibility rules and the view_other_topics permission. The quote endpoint omits these checks entirely.

Because the backend helper in modules/Forum/classes/Forum.php does not re-validate that the requesting user can view the parent forum or topic, the quote action becomes a parallel read path that bypasses the site's access model. Attackers iterate sequential post IDs to harvest content from administrative, moderator, or private member forums.

Root Cause

The root cause is missing authorization in a sibling code path. The application enforces ACLs in the primary view function but reuses the data layer in a quote helper that omits permission checks. This pattern reflects [CWE-285] Improper Authorization, where a feature relies solely on authentication state rather than fine-grained forum and topic ACLs.

Attack Vector

Exploitation requires only a standard authenticated account on the target NamelessMC site. The attacker sends HTTP requests to the forum quote endpoint with incrementing post ID values. Each request that resolves to a valid post returns its content regardless of the parent forum's visibility settings or the user's group permissions. No interaction from privileged users is required, and the attack is fully scriptable against the network-reachable web interface.

For technical specifics, see the GitHub Security Advisory GHSA-2r6x-cv4f-h8fx.

Detection Methods for CVE-2026-33398

Indicators of Compromise

• Repeated HTTP requests from a single authenticated session to forum/get_quotes.php with sequential or randomized post ID values
• High request volume to the quote endpoint without corresponding view_topic.php traffic from the same session
• Account activity from low-privileged users producing access patterns inconsistent with normal forum browsing

Detection Strategies

• Parse web server access logs for query strings containing get_quotes.php?post= and group by session or user ID to identify enumeration patterns
• Alert when a single user issues more than a baseline threshold of distinct post ID values within a short window
• Correlate quote endpoint hits with topic view activity; quote requests without matching topic views indicate scraping behavior

Monitoring Recommendations

• Enable verbose application logging in NamelessMC to capture user IDs alongside requested post IDs
• Forward web server and PHP application logs to a centralized log analytics platform for retention and query
• Review staff and private forum content periodically for evidence of unauthorized access referenced in support tickets or external leaks

How to Mitigate CVE-2026-33398

Immediate Actions Required

• Upgrade NamelessMC to version 2.2.5 or later, which enforces forum and topic ACLs in the quote helper
• Audit forum logs for suspicious enumeration of get_quotes.php since the deployment of version 2.2.4
• Rotate or revoke sessions of accounts exhibiting suspicious quote endpoint activity
• Review the contents of staff-only and private forums to assess potential exposure

Patch Information

NamelessMC released version 2.2.5 to address CVE-2026-33398. The fix adds forum visibility and view_other_topics permission checks to the quote retrieval logic so that the secondary read path applies the same ACLs as view_topic.php. Administrators should obtain the update from the official NamelessMC distribution channel and review the GitHub Security Advisory for full release details.

Workarounds

• Restrict access to modules/Forum/pages/forum/get_quotes.php at the web server layer until the upgrade is applied
• Temporarily disable forum quoting functionality if a patch cannot be deployed immediately
• Limit new account registrations and require manual approval to reduce the pool of low-privileged accounts capable of exploiting the issue

# Example nginx rule to block the vulnerable endpoint pending upgrade
location ~* /modules/Forum/pages/forum/get_quotes\.php$ {
    return 403;
}