Medium severity4.3NVD Advisory· Published May 15, 2026· Updated May 15, 2026

CVE-2026-45009

Description

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

Affected products

Thorsten/Phpmyfaqinferred
Range: <4.1.2

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5nvd
www.vulncheck.com/advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpointsnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000