CVE-2026-43621

Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

We have discovered 3,187 live websites that are affected by CVE-2026-43621.

Run a Free Instant Scan



Affected Software

Product  SMF
Category Message Boards
Vulnerable Domains3,187 live websites (100% of SMF install base)
Vulnerable Versions
  • from 0 through 2.1.7
Vulnerable Versions Count51 versions ( 100% of all versions)



Details

  • Published - Aug 26, 2026
  • Updated - Aug 26, 2026

Credits

  • abdullah0x1337 (finder)

Website Distribution by Country

Number of websites using CVE-2026-43621
United States959 websites


Germany411 websites
Russia394 websites
France185 websites
Poland148 websites
Netherlands117 websites
GB106 websites
Thailand92 websites
Italy72 websites
Bulgaria61 websites

Website Distribution by TLD

Number of websites using CVE-2026-43621
.com1,147 websites
.ru336 websites
.org305 websites
.net292 websites
.de186 websites
.pl115 websites
.info74 websites
.co.uk64 websites
.nl63 websites
.fr47 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-43621

Top websites that are affected by CVE-2026-43621. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*************.org United States*,***
***********.org United States*,***
********.org United States**,***
*************.it Italy**,***
*********.com Bulgaria***,***
********.com United States***,***
*********.ws United States***,***
*****.******.de Germany***,***
********.**.uk United States***,***
*****.***************.com France***,***
See full domain list

FAQ

A total of 3,187 websites have been identified as vulnerable to CVE-2026-43621, based on global website indexing conducted by WebTechSurvey.
The SMF is affected by the CVE-2026-43621 vulnerability.
SMF versions up to and including 2.1.7 are vulnerable to CVE-2026-43621.