Cloudanix VulnDB

GHSA-hpgw-ww76-c68r

Medium · 6.5

phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

CVSS

6.5

EPSS

—

Published

May 6, 2026

CISA due date

—

The record

`AbstractAdministrationController::userHasPermission()` catches the `ForbiddenException` thrown when a user lacks a specific permission, sends a "forbidden" HTML page via `$response->send()`, but does not terminate execution. The calling controller method continues to execute, fetches protected data, renders the full template, and returns it as a Response. The final `$response->send()` in `admin/index.php` outputs the protected page content after the forbidden page, leaking all permission-protected admin data to any authenticated admin user regardless of their actual permissions.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities