A single‑character operator error in Simple Machines Forum’s AttachmentApprove.php causes the permission check to always succeed. An authenticated user with no approve_posts permission can approve, reject, or delete any pending attachment on any board. The flaw enables a low‑privileged attacker to bypass moderation queues for their own uploads, enumerate other users’ pending attachments, and delete them, thereby gaining unauthorized moderation capabilities.

Simple Machines Forum versions 2.1 before commit 7d048f8 and 3.0 before commit a7875e8 are vulnerable. The CVE does not list explicit version numbers, so any installation of 2.1 or 3.0 that has not applied the referenced commits remains at risk. Check the source repository or the installed package version to verify whether the security fix has been incorporated.

The CVSS base score is 7.1, indicating a high severity. EPSS is < 1%, which suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be an authenticated web session interacting with AttachmentApprove.php, as the flaw requires valid SMF credentials but does not grant full administrative rights. Given the absence of public exploits, the threat remains moderate to high for exposed installations lacking strict role separation.