p PatchFirst

CVE-2026-45009

CVE-2026-45009 · phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints

This page contains facts from public vulnerability sources. Check the original advisory before updating.

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • phpmyfaq

    Versions
    • ≥ 4.1.1, < 4.1.2: Affected (semver)
    • 4.1.2: Not affected (semver)

    Update to 4.1.2

  • thorsten/phpmyfaq Packagist

    Versions
    • 4.1.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.1.1, < 4.1.2

    Update to 4.1.2

  • phpmyfaq/phpmyfaq Packagist

    Versions
    • 4.1.1
    Affected ranges
    • ECOSYSTEM: ≥ 4.1.1, < 4.1.2

    Update to 4.1.2

Original sources

Check your server →