CVE-2026-46362 | BDVDB-2026-333633 Detail

Description#

phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-15Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.