Cpe:2.3:a:simple_machines:forum:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asimple_machinesforum/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 03:09:42 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSimple Machines Forum: Authorization bypass in profile controller (CVE-2026-43621)https://feed.craftedsignal.io/briefs/2026-10-smf-authz-bypass/Tue, 27 Oct 2026 03:09:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-smf-authz-bypass/An authorization bypass vulnerability in Simple Machines Forum 3.0 allows authenticated users to access other members profile settings, presenting an account takeover risk via unauthorized password changes.CVE-2026-43621 is an authorization flaw in the Simple Machines Forum (SMF) 3.0 profile controller. The Profile::load() function fails to validate the u (user) parameter against the authenticated session, allowing an attacker to request the account settings form of any member. Accessing this form is considered equivalent to account takeover, as the returned page contains the password change fields. The vulnerability is confirmed in SMF 3.0; versions 2.1.x are not affected.

Impact

Successful exploitation allows low-privilege users to access the profile settings of arbitrary members, including the account-takeover password-change interface.

Recommendation

  • Upgrade to the release containing commit 6f0dc61958aa.
  • Until patched, implement WAF or reverse proxy rules to block action=profile requests where the u parameter does not match the authenticated user ID. Note that attackers may use obfuscated parameter variants such as array syntax (u[]), null bytes, or mixed separators to bypass naive filters.
]]>highadvisoryweb-vulnerabilityauthorization-bypassaccount-takeover