CVE-2026-43621: Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->isowner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Simple Machines Forum (SMF)to a version that resolves this vulnerability.Fixed in 2.1.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6f0dc61
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged SMF user can exploit it. No user interaction is required.
What does an attacker need to do to gain administrator access?
The attacker must supply multiple values for the user parameter during sequential profile loading. This can cause the profile loader's authorization state to treat the attacker as the owner of an administrator profile.
What is the impact of successful exploitation?
An attacker can make unauthorized password changes to an administrator account and take over that account. This results in administrator-level access.
Which installations are affected, and what is the available fix?
SMF through version 2.1.7 is affected. The issue is fixed in commit 6f0dc61958aa86a4b436a222f6176812ed5bbb95.