CVE-2026-33398 is an improper authorization vulnerability (CWE-285) in NamelessMC Nameless version 2.2.4. The vulnerability exists in the forum module where the get_quotes.php endpoint fails to enforce forum or topic ACLs, allowing any authenticated user to read posts from restricted forums by enumerating post IDs. The normal forum topic page enforces visibility and permissions correctly, but the backend helper used by get_quotes.php does not. This leads to unauthorized disclosure of forum content. The issue is resolved in version 2.2.5.

An attacker with any authenticated user privileges can access and read content from hidden, private, or staff-only forums that they should not have permission to view. This results in unauthorized information disclosure. There is no indication of privilege escalation or remote code execution. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), reflecting the network attack vector, low attack complexity, no user interaction, and high confidentiality impact.

Upgrade NamelessMC to version 2.2.5 or later, where this improper authorization vulnerability is fixed. There is no official patch link provided, but the vendor has addressed the issue in the subsequent release. Until upgrading, restrict access to the vulnerable endpoint or disable the forum module if feasible. Patch status is not explicitly confirmed in the advisory, so check the vendor's official release notes for confirmation and further guidance.