CVE-2026-45009: phpMyFAQ insufficient authorization in admin-api routes

Executive brief

phpMyFAQ is an open-source FAQ software. A security flaw allows any registered user to access administrative API endpoints that should be restricted to managers. While this does not allow users to change settings, it does allow them to view sensitive internal information such as server configurations, LDAP settings, and system health status.

Technical details

An incorrect authorization vulnerability exists in phpMyFAQ's Administration\Api controllers. The affected controllers, including DashboardController, LdapController, and UpdateController, use the userIsAuthenticated() check instead of userHasPermission(). This allows any user with a valid session—regardless of their privilege level—to query endpoints under the /admin/api/ namespace. An attacker can exploit this to disclose sensitive operational data, including LDAP configurations, Elasticsearch statistics, and system version information. The vulnerability is present in version 4.1.1 and is addressed in version 4.1.2.

Affected products

• thorsten phpMyFAQ 4.1.1

Timeline

• 2026-04-28: disclosed
• 2026-05-06: advisory: GitHub Advisory published
• 2026-04-28: patched: Fix released in version 4.1.2

References

• https://api.github.com/users/kitu232
• https://github.com/kitu232
• https://api.github.com/users/kitu232/gists%7B/gist_id%7D
• https://api.github.com/users/kitu232/repos
• https://avatars.githubusercontent.com/u/90661022?v=4
• https://api.github.com/users/kitu232/events%7B/privacy%7D