PT-2026-41356 · Phpmyfaq · Phpmyfaq

Kitu232 · Published 2026-05-06 · Updated 2026-05-15 · CVE-2026-45009

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.2

Description Insufficient authorization in 'admin-api' routes allows authenticated ordinary users to access administrative endpoints. The system only verifies login status without checking for backend privileges, enabling attackers with valid frontend accounts to access sensitive operational information, such as dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

Recommendations Update to version 4.1.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-45009

GHSA-9R8R-X3VG-6XH4

GHSA-JRC5-W569-H7H5

Affected Products

Phpmyfaq

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45009.json · Exploit
• 🔥 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45009 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45009 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jrc5-w569-h7h5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9r8r-x3vg-6xh4 · Vendor Advisory
• https://github.com/thorsten/phpMyFAQ · Note
• https://t.me/cveNotify/163685 · Telegram Post
• https://vulncheck.com/advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpoints · Note