Flarum Extension Manager CVE-2026-112291

No special conditions for the request itself - remote unauthenticated exploitation against default configurations via GET /api/extension-manager-tasks. The limiting factors are deployment-based: the target must be running the Flarum Extension Manager (package-manager) extension at an affected version (2.0.0-beta.1 through 2.0.0-beta.7), the extension must be installed and enabled, and the API endpoint must be network-reachable. Exploitation yields only limited read access to task output (paths, extension/PHP versions), not write access or code execution.

This is a medium-severity unauthenticated information-disclosure flaw (CWE-862 Missing Authorization) in the Flarum Extension Manager. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a fully remote, low-complexity, unauthenticated attack against a network-reachable endpoint, which raises reachability; however, impact is bounded - only VC:L (limited confidentiality) with no integrity (VI:N) or availability (VA:N) impact and no scope change. The disclosed data (filesystem paths, installed extensions and versions, PHP version) is reconnaissance-grade rather than directly damaging, which is why the score lands at 6.9 (medium) rather than critical. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public exploit code was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: this is a genuine but modest priority - easy to exploit and useful for fingerprinting/chaining into targeted follow-up attacks, but not a standalone high-impact issue. The GitHub commit evidence (adding ->authenticated() and ->admin() guards, plus regression tests asserting 401 for guests and 403 for normal users) independently confirms both the root cause and the fix, giving high confidence in the technical details.

An attacker enumerating a Flarum forum sends an unauthenticated GET request to /api/extension-manager-tasks and receives task output exposing server filesystem paths, the list and versions of installed extensions, and the PHP version. The attacker uses this fingerprint to identify other vulnerable or outdated components and tailor a follow-up attack. No public exploit code was provided, but the request is trivial to reproduce from the CVE description and requires no authentication.