CVE-2026-43621

Received Received - Intake

Authorization Bypass in Simple Machines Forum

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-43621

EUVD

EUVD-2026-66768

Affected Vendors & Products

Vendor	Product	Version / Range
simple_machines_forum	smf	2.1.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Simple Machines Forum (SMF) through version 2.1.7 has an authorization state-confusion vulnerability in the profile loader. An authenticated low-privileged user can gain administrator access by providing multiple values for the user parameter. This exploits a mismatch between Profile::$member and User::$me->is_owner during sequential profile loading, allowing the attacker to be treated as the owner of an administrator profile.

Impact Analysis

This vulnerability allows an attacker with low privileges to escalate their access to administrator privileges. Once exploited, the attacker can change passwords and take over administrator accounts, leading to full control of the forum and potential data breaches or unauthorized actions.

Compliance Impact

This vulnerability allows low-privileged users to gain administrator access, potentially leading to unauthorized access to sensitive data. This could violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access or modification of personal or protected health information.

Mitigation Strategies

Update Simple Machines Forum to the latest version or apply the commit 6f0dc61 fix to address the authorization state-confusion vulnerability in the profile loader.

Hi! I’m here to help you understand CVE-2026-43621. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70