CVE-2026-43621

Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

State: Published
Severity: 8.6 High
Published: Aug 26, 2026
Updated: Oct 1, 2026
Reserved: May 1, 2026

Description

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
SMFSimpleMachines	2.1.7 and earlierAffected 6f0dc61958aa86a4b436a222f6176812ed5bbb95Not affected

References

Patch Commitpatch
https://www.vulncheck.com/advisories/simple-machines-forum-authorization-confusion-via-profile-loadthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.