Is there a patch available for CVE-2026-45007?

Yes, a patch is available for CVE-2026-45007. Update the affected software to the latest version immediately.

phpMyFAQ CVE-2026-45007

Q: What is the CVSS score of CVE-2026-45007?

CVE-2026-45007 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30591 MEDIUM

Missing Authorization (CWE-862)

2026-05-15 VulnCheck

GHSA-p26v-fx3x-r2rp

Authentication Bypass PHP

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 28, 2026 - 16:22 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Patch available

May 15, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 15, 2026 - 19:36 vuln.today

Analysis Generated

May 15, 2026 - 19:36 vuln.today

DescriptionCVE.org

phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider by querying /admin/api/configuration endpoints, violating least privilege access control.

AnalysisAI

Insufficient authorization in phpMyFAQ 4.1.1 and earlier allows any authenticated user to enumerate sensitive system configuration metadata through 12 admin API endpoints. The ConfigurationTabController improperly uses userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT), enabling low-privilege users to query /admin/api/configuration endpoints and discover the permission model, active template, cache backend, mail provider, translation settings, and other deployment details that should require administrative access. This information disclosure violates least privilege principles and aids reconnaissance for subsequent attacks. EPSS data not available; no active exploitation confirmed at time of analysis. Vendor-released patch available in version 4.1.2.

Technical ContextAI

phpMyFAQ is a PHP-based FAQ management system with role-based access control. The vulnerability stems from CWE-862 (Missing Authorization) in the Symfony-style controller architecture. The application relies entirely on controller-level authorization checks with no middleware or route-guard enforcement. The ConfigurationTabController defines 15 endpoints: 3 correctly invoke userHasPermission(CONFIGURATION_EDIT) which validates both authentication and the specific CONFIGURATION_EDIT permission via the Permission model, while 12 endpoints only call userIsAuthenticated() which checks login status without validating role permissions. This creates a privilege escalation where any user with valid credentials - regardless of assigned permissions - can access administrative metadata endpoints. The affected CPE cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:* indicates the Composer packages composer/thorsten/phpmyfaq and composer/phpmyfaq/phpmyfaq through version 4.1.1.

RemediationAI

Upgrade to phpMyFAQ 4.1.2 immediately via Composer: composer require thorsten/phpmyfaq:^4.1.2 or composer require phpmyfaq/phpmyfaq:^4.1.2 depending on package naming. Version 4.1.2 replaces userIsAuthenticated() with userHasPermission(PermissionType::CONFIGURATION_EDIT) across all 12 vulnerable endpoints in ConfigurationTabController.php, enforcing proper role-based access control. If immediate patching is blocked by testing requirements, implement application firewall rules to restrict /admin/api/configuration/* endpoints to source IPs of known administrators, understanding this breaks legitimate remote admin access and does not address the underlying authorization flaw. Alternatively, modify ConfigurationTabController.php directly to replace all userIsAuthenticated() calls with userHasPermission(PermissionType::CONFIGURATION_EDIT) in the 12 methods identified in the GitHub advisory (translations, templates, faqsSortingKey, and 9 others), then thoroughly test admin functionality. Review authentication logs for unexpected access to /admin/api/configuration endpoints by non-administrative users since deployment. Full remediation details and affected endpoint list available at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rm98-82fr-mcfx and https://www.vulncheck.com/advisories/phpmyfaq-missing-permission-check-on-12-configuration-api-endpoints-allows-information-disclosure.