CVE-2026-46362: phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check
phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46362?
CVE-2026-46362 is categorized as a high severity vulnerability due to its potential to allow unauthorized access to admin functionalities.
How do I fix CVE-2026-46362?
To fix CVE-2026-46362, upgrade phpMyFAQ to version 4.1.2 or later where the vulnerability has been patched.
What systems are affected by CVE-2026-46362?
CVE-2026-46362 affects phpMyFAQ versions prior to 4.1.2.
What type of vulnerability is CVE-2026-46362?
CVE-2026-46362 is an authorization bypass vulnerability.
Can CVE-2026-46362 lead to data breaches?
Yes, attackers exploiting CVE-2026-46362 could potentially gain unauthorized access to sensitive admin pages, leading to data breaches.