Insufficient Authorization in phpMyFAQ Affects User Access Control
CVE-2026-45009

4.3MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
15 May 2026

What is CVE-2026-45009?

An insufficient authorization vulnerability in phpMyFAQ prior to version 4.1.2 allows authenticated ordinary users to access sensitive administrative endpoints. This vulnerability arises from merely validating the user's login status without checking their specific backend privileges. As a result, attackers with valid frontend accounts can exploit this flaw to gain unauthorized access to confidential backend information, such as dashboard versions, LDAP configurations, Elasticsearch statistics, and health-check data.

Affected Version(s)

phpmyfaq 4.1.1 < 4.1.2

phpmyfaq 4.1.2

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-insufficien...
third-party-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kitu232
.