CVE-2026-43621: Incorrect Authorization in SimpleMachines SMF
Description
Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.
CVSS v4.0
Score 8.6high
Affected software
SimpleMachines
SMF
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-43621 is an authorization state-confusion vulnerability in Simple Machines Forum (SMF) through version 2.1.7. The flaw arises in the profile loader component, where supplying multiple values for the user parameter causes a mismatch between Profile::$member and User::$me->is_owner during sequential profile loading. This mismatch allows an authenticated low-privileged user to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover. The issue is fixed in a commit identified as 6f0dc61.
Potential Impact
An attacker with authenticated low-privileged access can exploit this vulnerability to gain administrator privileges. This leads to unauthorized password changes and full account takeover of administrator accounts, compromising the integrity and control of the affected SMF installation.
Mitigation Recommendations
A fix is available and was introduced in commit 6f0dc61. Users should upgrade to a version that includes this fix or apply the patch corresponding to this commit to remediate the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-01T18:22:45.640Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8f63b0acd9273b4970b50a
Added to database: 08/26/2026, 22:07:44 UTC
Last enriched: 10/02/2026, 15:50:04 UTC
Last updated: 10/09/2026, 06:48:17 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.