CVE-2026-33398: Authenticated users can read hidden forum posts through `/forum/get_quotes`

Synopsis

This is an authorization bypass (broken access control) in NamelessMC, the open-source website platform for Minecraft server communities. An attacker who holds any valid user account can send crafted requests to the `/forum/get_quotes` endpoint, supplying arbitrary post IDs to retrieve content from hidden, private, or staff-only forums that they should not have access to. Successful exploitation gives the attacker read access to restricted forum posts without needing any elevated permissions. A patched-image rebuild at version 2.2.5 is available on HarborGuard for environments running the affected 2.2.4 image.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the NamelessMC web service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege registered account is sufficient; the endpoint checks only for a valid login session, not for any elevated role.

• Victim interactionNot required

  No victim action is needed; the attacker sends requests directly to the endpoint without involving another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply increments post IDs in requests, with no race condition or environmental dependency required.

Blast Radius

• The attacker reads the full text content of posts in hidden, private, or staff-only forums that are intentionally restricted from their account.
• Sequential enumeration of post IDs allows bulk harvesting of restricted content across multiple forums and topics in a single session.
• Sensitive information stored in staff forums, such as moderation decisions, ban reasons, or internal server administration discussions, is exposed to any registered user.