---
id: CVE-2026-45009
title: phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints
summary: >-
  phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in
  admin-api routes that allows authenticated ordinary users to access
  administrative endpoints by only checking login status instead of verifying
  backend privile…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: thorsten
product: phpmyfaq
affected:
  - phpmyfaq >= 4.1.1 < 4.1.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-15T20:04:40.405815Z'
exploitAvailable: true
published: '2026-05-15'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:35.119Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45009'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5
    label: GitHub Security Advisory (GHSA-jrc5-w569-h7h5)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpoints
    label: >-
      VulnCheck Advisory: phpMyFAQ - Insufficient Authorization Check in Admin
      API Endpoints
tags:
  - cve.org
  - exploit-available
epss: 0.00211
epssPercentile: 0.11325
ingestedAt: '2026-11-08T14:51:22.426Z'
---

## Overview

phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.

## Affected

- `phpmyfaq >= 4.1.1 < 4.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.