medium4.3
CVE-2026-45007
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermi…
Impact
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider by querying /admin/api/configuration endpoints, violating least privilege access control.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | thorsten/phpmyfaq | <= 4.1.1 | 4.1.2 |
| composer | phpmyfaq/phpmyfaq | <= 4.1.1 | 4.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-rm98-82fr-mcfx
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rm98-82fr-mcfx
- https://nvd.nist.gov/vuln/detail/CVE-2026-45007
- https://www.vulncheck.com/advisories/phpmyfaq-missing-permission-check-on-12-configuration-api-endpoints-allows-information-disclosure