{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asimple_machinesforum/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:simple_machines:forum:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-43621"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Simple Machines Forum (3.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","authorization-bypass","account-takeover"],"_cs_type":"advisory","_cs_vendors":["Simple Machines"],"content_html":"\u003cp\u003eCVE-2026-43621 is an authorization flaw in the Simple Machines Forum (SMF) 3.0 profile controller. The \u003ccode\u003eProfile::load()\u003c/code\u003e function fails to validate the \u003ccode\u003eu\u003c/code\u003e (user) parameter against the authenticated session, allowing an attacker to request the account settings form of any member. Accessing this form is considered equivalent to account takeover, as the returned page contains the password change fields. The vulnerability is confirmed in SMF 3.0; versions 2.1.x are not affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privilege users to access the profile settings of arbitrary members, including the account-takeover password-change interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to the release containing commit 6f0dc61958aa.\u003c/li\u003e\n\u003cli\u003eUntil patched, implement WAF or reverse proxy rules to block \u003ccode\u003eaction=profile\u003c/code\u003e requests where the \u003ccode\u003eu\u003c/code\u003e parameter does not match the authenticated user ID. Note that attackers may use obfuscated parameter variants such as array syntax (\u003ccode\u003eu[]\u003c/code\u003e), null bytes, or mixed separators to bypass naive filters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T03:09:42Z","date_published":"2026-10-27T03:09:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-smf-authz-bypass/","summary":"An authorization bypass vulnerability in Simple Machines Forum 3.0 allows authenticated users to access other members profile settings, presenting an account takeover risk via unauthorized password changes.","title":"Simple Machines Forum: Authorization bypass in profile controller (CVE-2026-43621)","url":"https://feed.craftedsignal.io/briefs/2026-10-smf-authz-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:simple_machines:forum:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}