Authorization State-Confusion Vulnerability in Simple Machines Forum by Simple Machines

CVE-2026-43621

What is CVE-2026-43621?

An authorization state-confusion vulnerability exists in Simple Machines Forum that permits authenticated low-privileged users to gain unauthorized administrator access. By manipulating multiple values of the user parameter during profile loading, attackers can exploit the discrepancy between profile ownership checks. This flaw allows them to impersonate an administrator, leading to unauthorized password changes and complete account compromise. Users are highly encouraged to update to versions beyond 2.1.7 to mitigate potential risks associated with this vulnerability.

References