FastAdmin EUVD-2026-88620

Requires an authenticated administrative session on FastAdmin (PR:H) with access to the Database Management component (application/database.php), plus user interaction (UI:P per the CVSS 4.0 vector). It is not exploitable by an unauthenticated remote attacker against a default install - the backend admin panel and its database-management feature must be reachable and the attacker must already hold admin-level access or coerce an admin into interacting. This admin-only gating is the primary factor limiting real-world exploitation despite the network attack vector.

The vendor CVSS 4.0 vector (AV:N/AC:L/PR:H/UI:P, full VC/VI/VA:H, score 7.1) describes a network-reachable but heavily gated flaw: exploitation requires high privileges (PR:H - an authenticated administrator) AND user interaction (UI:P). Once triggered, impact is high across confidentiality, integrity, and availability of the vulnerable system, with no scope change (SC/SI/SA:N). A public proof-of-concept exists (VulDB E:P, GitHub baguette168/CVE issue #2), so this is 'publicly available exploit code exists' - but there is NO EPSS score and NO CISA KEV listing, so there is no evidence of widespread or active exploitation. The dominant risk-limiting signal is PR:H: because the Database Management function (application/database.php) is an admin-only backend feature, an attacker must already hold an administrative session, which sharply narrows the realistic threat to post-authentication privilege abuse or a compromised/malicious admin rather than opportunistic remote attack. This is a moderate-priority, high-CVSS-but-high-precondition issue - real but not internet-wormable. Note the CWE-250 (execution with unnecessary privileges) framing plus the 'Privilege Escalation' tag: the substantive risk is that the database feature runs with more privilege than needed, so an admin can leverage it to reach OS/DB command execution beyond intended bounds.

An authenticated FastAdmin administrator (or an attacker who has hijacked an admin session) navigates to the Database Management feature and abuses application/database.php, which executes with unnecessary privileges, to run database/OS-level operations beyond the intended scope, yielding full compromise of the affected instance. A public PoC is available on GitHub (baguette168/CVE issue #2). Because the CVSS vector marks UI:P, the chain may also require luring another admin to interact with a crafted request/page.