funadmin forget.html getMember information disclosure

Vulnerability

Analysis [CVE-2026-2894]

What it is

A vulnerability in funadmin up to version 7.1.0-rc4 has been identified in the getMember function within the file app/frontend/view/login/forget.html. The root cause is that this function, which handles password reset operations, improperly exposes internal member details, leading to an information disclosure weakness [1]. The vendor was contacted but did not respond.

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication, as the affected file is part of the public-facing password reset interface. The exploit does not require any special network position beyond normal internet access, and a working exploit is publicly available, increasing the risk of widespread scanning and abuse [1].

Impact

Successful exploitation allows a remote, unauthenticated attacker to obtain sensitive information about registered members, such as usernames, emails, or other user identifiers. This information can facilitate further targeted attacks, such as phishing, credential stuffing, or social engineering against the FunAdmin user base.

Mitigation

As of the publication date (2026-02-21), the vendor has not released a patch or acknowledged the vulnerability. Operators of FunAdmin installations are advised to monitor the vendor's repository [2] for future updates and to consider implementing web application firewall (WAF) rules or temporarily disabling the password reset functionality if feasible.