Authentication Flaw in Flarum Extension Manager Affects Multiple Versions
CVE-2026-112291

6.9MEDIUM

Key Information:

Vendor

Flarum

Status
Extension Manager
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112291?

The Flarum Extension Manager versions prior to 2.0.0-beta.8 are susceptible to an authentication flaw that permits unauthenticated users to access sensitive task output. Attackers can exploit this vulnerability by sending GET requests to the /api/extension-manager-tasks endpoint, which exposes critical information such as filesystem paths, installed extensions, versions, and the PHP version in use. This lack of proper authorization mechanisms creates significant risks that could potentially compromise the integrity and security of the Flarum installation.

Affected Version(s)

Extension Manager 2.0.0-beta.1 < 2.0.0-beta.8

References

https://github.com/flarum/framework/issues/4386
issue-tracking
https://github.com/flarum/framework/commit/257989e71fd8cc...
patch
https://github.com/flarum/framework/releases/tag/v2.0.0-b...
release-notes

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.