The vulnerability in NamelessMC 2.2.4 allows unauthenticated users to retrieve reaction details on private profile posts via a GET request, and lets authenticated users with low privileges add reactions to those private or blocking posts. This provides attackers with visibility into the identity and actions of users who intended to keep their posts private, and can lead to unauthorized engagement on sensitive content. The weakness is a classic authorization bypass, categorized under CWE‑862. The impact is a breach of confidentiality and potential consent violations, but does not directly compromise the underlying system or leak credentials.

NamelessMC web platform for Minecraft servers, specifically version 2.2.4. The issue was addressed in version 2.2.5, which enforces proper visibility checks for reactions on private or blocking profile posts.

The CVSS score of 6.9 indicates a medium severity vulnerability. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by making unauthenticated GET requests or by simply adding reactions if they have low‑privilege access, meaning that denial of proper authorization controls is the primary risk factor. The presence of a dedicated fix in the next release indicates that the attack vector relies on insufficient access checks rather than complex conditions.