CVE-2026-45009: phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints
phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45009?
CVE-2026-45009 has a critical severity rating due to the potential for unauthorized access to administrative functions.
How do I fix CVE-2026-45009?
To fix CVE-2026-45009, update phpMyFAQ to version 4.1.2 or later where the vulnerability is patched.
What kind of systems are affected by CVE-2026-45009?
CVE-2026-45009 affects phpMyFAQ versions prior to 4.1.2, specifically all versions of phpMyFAQ before this release.
Who can be impacted by CVE-2026-45009?
Authenticated ordinary users can be impacted by CVE-2026-45009, as they can exploit the insufficient authorization to access admin endpoints.
What are the consequences of CVE-2026-45009?
The consequences of CVE-2026-45009 include potential unauthorized administrative actions, data exposure, and compromising the integrity of the phpMyFAQ application.