MEDIUM
phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure
Published May 15, 2026
5.3
MEDIUMCVSS 4.0
EPSS 0.28%
Description
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider by querying /admin/api/configuration endpoints, violating least privilege access control.
Affected products
-
Affected
- ≥ 0, < 4.1.2
Unaffected
- 4.1.2
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30591 Advisory
- https://github.com/advisories/GHSA-rm98-82fr-mcfx Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rm98-82fr-mcfx exploitvendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45007
- https://www.vulncheck.com/advisories/phpmyfaq-missing-permission-check-on-12-configuration-api-endpoints-allows-information-disclosure third-party-advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published May 15, 2026
Updated May 28, 2026
Reserved May 8, 2026
Link CVE-2026-45007
CISA Vulnrichment
Updated May 16, 2026
Red Hat
No data
GitHub
Link GHSA-RM98-82FR-MCFX