{"id":"CVE-2026-43621","title":"Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying mu…","summary":"Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying mu…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-863"],"published":"2026-08-26","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:28:01.780","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43621","references":[{"url":"https://github.com/SimpleMachines/SMF/commit/6f0dc61958aa86a4b436a222f6176812ed5bbb95","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/simple-machines-forum-authorization-confusion-via-profile-load","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00363,"epssPercentile":0.27396,"ingestedAt":"2026-09-24T20:51:40.233Z","slug":"CVE-2026-43621","body":"## Overview\n\nSimple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}