Simple Machines Forum: Authorization bypass in profile controller (CVE-2026-43621)
An authorization bypass vulnerability in Simple Machines Forum 3.0 allows authenticated users to access other members profile settings, presenting an account takeover risk via unauthorized password changes.
CVE search metadata
CVE search record: CVE-2026-43621. Severity: high. CVSS: 8.1. EPSS: 0.36%. KEV: no. Product: Simple Machines Forum (3.0). Brief: Simple Machines Forum: Authorization bypass in profile controller (CVE-2026-43621). Brief link: https://feed.craftedsignal.io/briefs/2026-10-smf-authz-bypass/
Triage facts
Revision 1- Applicability
- Simple Machines Forum (3.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 27, 03:09 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
CVE-2026-43621 is an authorization flaw in the Simple Machines Forum (SMF) 3.0 profile controller. The Profile::load() function fails to validate the u (user) parameter against the authenticated session, allowing an attacker to request the account settings form of any member. Accessing this form is considered equivalent to account takeover, as the returned page contains the password change fields. The vulnerability is confirmed in SMF 3.0; versions 2.1.x are not affected.
Impact
Successful exploitation allows low-privilege users to access the profile settings of arbitrary members, including the account-takeover password-change interface.
Recommendation
- Upgrade to the release containing commit 6f0dc61958aa.
- Until patched, implement WAF or reverse proxy rules to block
action=profilerequests where theuparameter does not match the authenticated user ID. Note that attackers may use obfuscated parameter variants such as array syntax (u[]), null bytes, or mixed separators to bypass naive filters.
Immediate actions
Patch SMF 3.0 to include commit 6f0dc61958aa
Threat Hunt
Search web logs for anomalous u= parameters
Data: Web access logs (cs-uri-query)
Mitigations
Implement WAF rules to validate the u parameter against authenticated session
CVE-2026-43621
Gaps
- Need to ensure WAF handles obfuscated query parameters
Detection coverage 1
Detect SMF Profile Authorization Bypass Attempt
mediumDetects suspicious access to profile account settings where the user ID parameter (u) is supplied, which may indicate exploitation of CVE-2026-43621
Detection queries are available on the platform. Get full rules →