The flaw in NamelessMC 2.2.4 lies in the reaction handling routine, where only the existence of a wall post is validated but visibility restrictions for private posts and block checks are omitted. This missing authorization allows an authenticated user with low privileges to attach reactions to posts that should remain hidden. The result is an unauthorized association of the user with private or blocked content, potentially infringing privacy and facilitating harassment. This issue is formally described as CWE‑862, indicating a missing authorization check.

NamelessMC version 2.2.4 is the only affected release; the patch that restores the authorization check was delivered in version 2.2.5 and applies to all later releases.

The CVSS score of 5.3 denotes moderate risk. EPSS data is not provided and the vulnerability is not listed in the CISA KEV catalog, implying no large‑scale exploitation to date. Based on the description, it is inferred that an attacker must already be authenticated and use the web interface that submits reaction data to exploit the bug. The impact is limited to privacy violations by allowing reactions on private or blocked posts, not a full system compromise.