Medium severity5.3NVD Advisory· Published Oct 19, 2026· Updated Oct 19, 2026
CVE-2026-112291
CVE-2026-112291
Description
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <2.0.0-beta.8
Patches
Vulnerability mechanics
References
5- github.com/flarum/framework/blob/v2.0.0-beta.6/extensions/package-manager/src/Api/Resource/TaskResource.phpnvd
- github.com/flarum/framework/commit/257989e71fd8cc7ddab20f31dcde1aa760b1a08fnvd
- github.com/flarum/framework/issues/4386nvd
- github.com/flarum/framework/releases/tag/v2.0.0-beta.8nvd
- www.vulncheck.com/advisories/flarum-extension-manager-2.0.0-beta.1-before-2.0.0-beta.8-missing-authorization-via-task-apinvd
News mentions
0No linked articles in our index yet.