PT-2026-21400 · Funadmin · Funadmin

I4M6Da · Publicado 2026-02-21 · Atualizado 2026-02-27 · CVE-2026-2896

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions funadmin versions up to 7.1.0-rc4

Description A weakness exists in funadmin that could lead to improper authorization. This is due to a manipulation possible in the setConfig function within the app/backend/controller/Ajax.php file of the Configuration Handler component. The attack can be executed remotely. The exploit has been made publicly available. The vendor was contacted but did not respond.

Recommendations Update funadmin to a version later than 7.1.0-rc4.

Exploit

Correção

Incorrect Privilege Assignment

Improper Authorization

Enumeração de Fraquezas

CWE-266

CWE-285

Identificadores relacionados

CVE-2026-2896

GHSA-5M2G-4CF6-C3RG

Produtos afetados

Funadmin

Referências · 15

• 🔥 https://github.com/I4m6da/CVE/issues/3#issue-3884949083 · Exploit
• 🔥 https://github.com/I4m6da/CVE/issues/3 · Exploit
• https://github.com/funadmin/funadmin · Nota
• https://twitter.com/CVEnew/status/2025425449728573610 · Publicação no Twitter
• https://vuldb.com/?id.347207 · Nota
• https://t.me/cveNotify/152742 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2896 · Nota de Segurança
• https://twitter.com/cracbot/status/2027337982068535568 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2025461265737580649 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-5m2g-4cf6-c3rg · Aviso do Fabricante
• https://t.me/CVEtracker/45401 · Publicação no Telegram
• https://t.me/cveNotify/153018 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2896 · Aviso do Fabricante
• https://vuldb.com/?submit.753972 · Nota
• https://vuldb.com/?ctiid.347207 · Nota