CVE-2026-39903 is an authorization bypass vulnerability in Simple Machines Forum (SMF) affecting versions 2.1 before 2.1.8 and 3.0 before 3.0 Alpha 5. The issue is caused by a single-character operator error in the Sources/Actions/AttachmentApprove.php file, which causes the permission check to always succeed regardless of the user's actual permissions. As a result, authenticated users with low privileges can perform actions normally restricted to users with the approve_posts permission, including approving, rejecting, or deleting pending attachments on any board. This flaw allows bypassing moderation controls and unauthorized enumeration and deletion of other users' attachments.

The vulnerability allows authenticated low-privileged users to bypass authorization checks and perform moderation actions on attachments without proper permissions. This can lead to unauthorized approval or rejection of attachments, bypassing moderation workflows, and deletion of other users' pending attachments. The integrity of the forum's content moderation process is compromised, potentially affecting trust and content management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, administrators should consider restricting authenticated user permissions carefully and monitor for suspicious activity related to attachment moderation.