Missing Authorization in phpMyFAQ - CVE-2026-45007
Published: May 5, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU130120
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45007
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose configuration metadata.
The vulnerability exists due to missing authorization in ConfigurationTabController admin API endpoints when handling authenticated requests to configuration tab endpoints. A remote user can send requests to the affected /admin/api/configuration endpoints to disclose configuration metadata.
The issue affects 12 GET endpoints and exposes details such as the permission model, active template, cache backend, mail provider, translation provider, and release environment.
Affected software
phpMyFAQ
How to mitigate CVE-2026-45007
Install security update from vendor's website.
phpMyFAQ - update to 4.1.2