CVE-2026-39903

Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve_posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/SimpleMachines/SMF/commit/7d048f8d66aab9af51cd6ee110fbad103cf673e8
https://github.com/SimpleMachines/SMF/commit/a7875e876a647572dd4c45da881b875092caac3d
https://github.com/SimpleMachines/SMF/pull/9181
https://github.com/SimpleMachines/SMF/pull/9182
https://www.vulncheck.com/advisories/simple-machines-forum-authorization-bypass-via-attachmentapprove-php

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Simple Machines Forum 2.1 anterior a 2.1.8 y 3.0 anterior a 3.0 Alpha 5 contiene una vulnerabilidad de bypass de autorización en Sources/Actions/AttachmentApprove.php donde un error de operador de un solo carácter causa que la verificación de permisos siempre pase independientemente de los permisos del usuario. Un usuario autenticado con bajos privilegios puede aprobar, rechazar o eliminar cualquier archivo adjunto pendiente en cualquier foro sin poseer el permiso approve_posts requerido, eludir las colas de moderación para sus propias cargas, y enumerar y eliminar los archivos adjuntos pendientes de otros usuarios.

Information

Published : 2026-07-10 17:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-39903

Mitre link : CVE-2026-39903

CVE.ORG link : CVE-2026-39903

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-39903", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39903", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T01:56:17.608329Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/SimpleMachines/SMF", "vendor": "SimpleMachines", "product": "SMF", "versions": [{"status": "affected", "version": "2.1.0", "versionType": "semver", "lessThanOrEqual": "2.1.7"}, {"status": "unaffected", "version": "7d048f8d66aab9af51cd6ee110fbad103cf673e8", "versionType": "git"}, {"status": "affected", "version": "3.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "a7875e876a647572dd4c45da881b875092caac3d", "versionType": "git"}], "packageURL": "pkg:github/SimpleMachines/SMF", "defaultStatus": "affected"}]}], "published": "2026-07-10T17:16:57.230", "references": [{"url": "https://github.com/SimpleMachines/SMF/commit/7d048f8d66aab9af51cd6ee110fbad103cf673e8", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SimpleMachines/SMF/commit/a7875e876a647572dd4c45da881b875092caac3d", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SimpleMachines/SMF/pull/9181", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/SimpleMachines/SMF/pull/9182", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/simple-machines-forum-authorization-bypass-via-attachmentapprove-php", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without holding the required approve_posts permission, bypass moderation queues for their own uploads, and enumerate and delete other users' pending attachments."}, {"lang": "es", "value": "Simple Machines Forum 2.1 anterior a 2.1.8 y 3.0 anterior a 3.0 Alpha 5 contiene una vulnerabilidad de bypass de autorizaci\u00f3n en Sources/Actions/AttachmentApprove.php donde un error de operador de un solo car\u00e1cter causa que la verificaci\u00f3n de permisos siempre pase independientemente de los permisos del usuario. Un usuario autenticado con bajos privilegios puede aprobar, rechazar o eliminar cualquier archivo adjunto pendiente en cualquier foro sin poseer el permiso approve_posts requerido, eludir las colas de moderaci\u00f3n para sus propias cargas, y enumerar y eliminar los archivos adjuntos pendientes de otros usuarios."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}