PT-2026-21400 · Funadmin · Funadmin

I4M6Da · Published 2026-02-21 · Updated 2026-02-27 · CVE-2026-2896

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions funadmin versions up to 7.1.0-rc4

Description A weakness exists in funadmin that could lead to improper authorization. This is due to a manipulation possible in the setConfig function within the app/backend/controller/Ajax.php file of the Configuration Handler component. The attack can be executed remotely. The exploit has been made publicly available. The vendor was contacted but did not respond.

Recommendations Update funadmin to a version later than 7.1.0-rc4.

Exploit

Fix

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-266

CWE-285

Related Identifiers

CVE-2026-2896

GHSA-5M2G-4CF6-C3RG

Affected Products

Funadmin

References · 15

• 🔥 https://github.com/I4m6da/CVE/issues/3#issue-3884949083 · Exploit
• 🔥 https://github.com/I4m6da/CVE/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2896 · Security Note
• https://osv.dev/vulnerability/GHSA-5m2g-4cf6-c3rg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2896 · Vendor Advisory
• https://github.com/funadmin/funadmin · Note
• https://twitter.com/CVEnew/status/2025425449728573610 · Twitter Post
• https://vuldb.com/?id.347207 · Note
• https://t.me/cveNotify/152742 · Telegram Post
• https://twitter.com/cracbot/status/2027337982068535568 · Twitter Post
• https://twitter.com/CVEarity/status/2025461265737580649 · Twitter Post
• https://t.me/CVEtracker/45401 · Telegram Post
• https://t.me/cveNotify/153018 · Telegram Post
• https://vuldb.com/?submit.753972 · Note
• https://vuldb.com/?ctiid.347207 · Note