phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints

published 2026-05-06 6 mo ago modified 2026-11-08 18 h ago also EUVD-2026-30592 , GHSA-jrc5-w569-h7h5

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

Patch / fix

fixed in 3

packagist thorsten/phpmyfaq 4.1.2
packagist phpmyfaq/phpmyfaq 4.1.2
thorsten phpmyfaq 4.1.2

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-05-15)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
packagist	thorsten/phpmyfaq	>=4.1.1, <4.1.2	4.1.2
packagist	phpmyfaq/phpmyfaq	>=4.1.1, <4.1.2	4.1.2

Affected products

thorsten phpmyfaq

Classification

Weakness

CWE-863 Incorrect Authorization

References

github.com /thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5
vendor-advisory, exploit, web
vulncheck.com /advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpoints
third-party-advisory, web
nvd.nist.gov /vuln/detail/CVE-2026-45009
advisory
github.com /thorsten/phpMyFAQ
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary