GHSA-5m2g-4cf6-c3rg CVE-2026-2896
funadmin has Incorrect Privilege Assignment in its Configuration Handler
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.33%
- Chance of exploitation in the next 30 days. Higher than 25.62% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-266 Incorrect Privilege Assignment
- Fix
- None yet
- No fixed version published
Description
A weakness has been identified in funadmin up to 7.1.0-rc4. This affects the function setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| funadmin/funadmin | <= 7.1.0-rc4 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
- Exploit maturity
- Proof of concept
CVSS 3.1 7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
References
Advisories
Exploits and evidence
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qhh7-263p-54r3 Funadmin has an Improper Access Control Issue | High | Also affects funadmin/funadmin |
| GHSA-gcxp-xg77-798j funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function | Medium | Also affects funadmin/funadmin |
| GHSA-rfh7-7v27-6p9r funadmin: XSS through Value argument in Backend Interface component | Medium | Also affects funadmin/funadmin |
| GHSA-fmr2-m7gc-577w funadmin has Weak Password Recovery Mechanism for Forgotten Password | High | Also affects funadmin/funadmin |
| GHSA-8hhx-xq9j-xwfj funadmin exposes sensitive information via getMember function | Critical | Also affects funadmin/funadmin |
| GHSA-j9wp-x5q5-xh2f Funadmin Cross-site Scripting vulnerability | Medium | Also affects funadmin/funadmin |
| GHSA-2mv8-jjm5-f3hr SQL injection in funadmin | High | Also affects funadmin/funadmin |
| GHSA-h345-r48x-g68f SQL injection in funadmin | High | Also affects funadmin/funadmin |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor