What is the CVSS score of CVE-2026-2894?

CVE-2026-2894 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Funadmin are affected by CVE-2026-2894?

Organizations using funadmin should be aware of moderate risk from CVE-2026-2894, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.

Is there a public PoC exploit available for CVE-2026-2894?

Yes, a public proof-of-concept exploit is available for CVE-2026-2894. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2894?

Within 30 days: Identify affected systems running funadmin and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Funadmin CVE-2026-2894

MEDIUM

Information Exposure (CWE-200)

2026-02-21 cna@vuldb.com

GHSA-8hhx-xq9j-xwfj

Information Disclosure Funadmin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

PoC Detected

Feb 24, 2026 - 16:48 vuln.today

Public exploit code

CVE Published

Feb 21, 2026 - 23:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Funadmin versions up to 7.1.0-rc4 contain an information disclosure vulnerability in the password recovery function that allows unauthenticated remote attackers to access sensitive user data. Public exploit code is available for this vulnerability, and the vendor has not released a patch despite early notification. The low CVSS score of 5.3 reflects limited impact, though organizations running affected versions should implement compensating controls until an update is available.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Funadmin. A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.