Medium severity · published May 15, 2026
CVE-2026-45009
phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
phpmyfaq · thorsten
4.1.1 before 4.1.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45009
github.com
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5
www.vulncheck.com
https://www.vulncheck.com/advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpoints
More from phpmyfaq
9.8
CVE-2026-111911
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
9.8
CVE-2026-46364
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
9.4
CVE-2026-66398
phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
9.1
CVE-2026-45010
phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint
8.8
CVE-2026-75918
phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File