CVE-2026-45007: phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure
phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATIONEDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider by querying /admin/api/configuration endpoints, violating least privilege access control.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45007?
CVE-2026-45007 is classified as a medium severity vulnerability due to the potential for unauthorized information disclosure.
How do I fix CVE-2026-45007?
To fix CVE-2026-45007, upgrade phpMyFAQ to version 4.1.2 or higher where the missing permission checks have been addressed.
What kind of information is at risk due to CVE-2026-45007?
CVE-2026-45007 can lead to the disclosure of sensitive configuration information accessible to unauthenticated users.
Which software versions are affected by CVE-2026-45007?
CVE-2026-45007 affects phpMyFAQ versions prior to 4.1.2.
Is CVE-2026-45007 a coding error?
Yes, CVE-2026-45007 is due to a coding error where the application checks for user authentication instead of the necessary permissions.