What’s Vulnerable › Vulnerabilities

CVE-2026-45009: phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-15 · updated 2026-10-26
• Weakness: CWE-863

Description

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

Affected products

• thorsten phpMyFAQ: from 4.1.1 before 4.1.2 — fixed in 4.1.2

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5
• https://www.vulncheck.com/advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpoints
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5

Get alerted when CVE-2026-45009 or the next vulnerability affects your stack