The flaw in NamelessMC 2.2.4 permits any logged‑in user to retrieve the contents of hidden, private or staff‑only forum posts by calling /forum/get_quotes with a user‑controlled post ID. The request only verifies that the caller is authenticated and nowhere checks the forum or topic access control lists; consequently the backend returns the post to the requester regardless of its visibility. This constitutes an improper authorization weakness (CWE‑285).

This vulnerability affects NamelessMC software supplied by Nameless. It is present in version 2.2.4 and was removed with the release of version 2.2.5. No other products or broader vendor suites are listed as affected.

The CVSS score of 7.1 highlights a high severity impact. Although the EPSS score is not published and the issue is not listed in the CISA KEV, any authenticated user can enumerate sequential post identifiers and read hidden content with minimal effort, leading to unauthorized disclosure of private forum information. The lack of view or ACL enforcement on the endpoint makes the attack vector trivial once a valid login is available.