CVE-2026-43621

SMF: Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

SimpleMachines SMF

CVSS

8.6High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 26 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published26 Aug 2026Updated 1 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

26 Aug 2026, 21:27 UTCPublishedCVE List
27 Oct 2026, 00:13 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

KharalDipendra/CVE-2026-43621GitHub proof-of-concept repositories, 27 Oct 2026Exploit code

Description

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

Text from CVE List

Affected versions 2

SMFaffected: all versions through 2.1.7CVE List
SMFunaffected: 6f0dc61958aa86a4b436a222f6176812ed5bbb95CVE List