CVE-2025-30357
📋 TL;DR
In NamelessMC versions 2.1.4 and earlier, when an administrator deletes a spammer's account, all posts by that user are deleted along with entire discussion topics created by other users. This affects all NamelessMC installations running vulnerable versions where administrators manage user accounts.
💻 Affected Systems
- NamelessMC
📦 What is this software?
Nameless by Namelessmc
⚠️ Risk & Real-World Impact
Worst Case
Malicious users could intentionally spam to trigger account deletion, causing administrators to inadvertently delete legitimate discussion topics and content from other users, potentially wiping community discussions.
Likely Case
Administrators dealing with spam accounts delete them, unintentionally removing legitimate topics and comments from other users, disrupting community discussions.
If Mitigated
With proper monitoring and manual content review before account deletion, impact is limited to minor content loss that can be restored from backups.
🎯 Exploit Status
Exploitation requires creating spam accounts and waiting for administrator action. No special technical skills needed beyond basic account creation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0
Vendor Advisory: https://github.com/NamelessMC/Nameless/security/advisories/GHSA-22mc-7c9m-gv8h
Restart Required: No
Instructions:
1. Backup your current installation and database. 2. Download NamelessMC v2.2.0 from GitHub releases. 3. Replace all files with the new version. 4. Run any database migrations if prompted.
🔧 Temporary Workarounds
Manual Content Review Before Deletion
allReview all posts by a user before deleting their account, and manually preserve important topics created by other users.
Temporary Account Suspension
allSuspend spam accounts instead of deleting them to prevent topic deletion while awaiting patch.
🧯 If You Can't Patch
- Implement regular database backups to restore deleted content
- Limit account deletion privileges to senior administrators only
🔍 How to Verify
Check if Vulnerable:
Check NamelessMC version in admin panel or core/classes/Core.php file version constantCheck Version:
Check admin panel or grep 'define(\'NAMELESS_VERSION\'' core/classes/Core.phpVerify Fix Applied:
Verify version is 2.2.0 or later and test that deleting a test user account does not delete topics created by other users📡 Detection & Monitoring
Log Indicators:
- Multiple user account deletions by administrators
- Sudden decrease in forum topic counts
- User complaints about missing topics
Network Indicators:
- Increased account creation activity followed by account deletion events
SIEM Query:
event.action:"user_delete" AND event.outcome:"success" AND user.name:"admin"