CVE-2026-112291: Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flarum Extension Managerto a version that resolves this vulnerability.Fixed in 2.0.0-beta.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Flarum Extension Manager from 2.0.0-beta.1 through versions before 2.0.0-beta.8 are affected if the TaskResource index endpoint is reachable over the network.
What does an attacker need to exploit this issue?
An attacker needs no authentication, privileges, or user interaction. They can send a GET request to /api/extension-manager-tasks remotely.
What information can be disclosed?
The endpoint can expose task output containing filesystem paths, installed extension names and versions, and the PHP version.
How can I check whether a deployment is affected?
Request /api/extension-manager-tasks without authenticating. If it returns task output or task information, the endpoint is exposing data to unauthenticated users.
What should be done if immediate patching is not possible?
Restrict unauthenticated network access to /api/extension-manager-tasks until the Extension Manager can be updated to 2.0.0-beta.8 or later.