Cloudanix VulnDB

GHSA-jrc5-w569-h7h5

Medium · 4.3

phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ

CVSS

4.3

EPSS

—

Published

May 6, 2026

CISA due date

—

The record

A review of `phpMyFAQ-main` uncovered an authorization issue in the `admin-api` routes. Several backend endpoints only check whether the caller is logged in. They do not verify that the caller actually has backend or administrative privileges. As a result, a normal frontend user can access API endpoints that are clearly intended for administrative use. During local reproduction, a regular user account was able to request `/admin/api/index.php/dashboard/versions` and receive a successful response from the backend management API. This issue does not appear to give direct write access in the affected paths that were confirmed, so it should be treated as a backend information disclosure and privilege boundary failure rather than full admin compromise.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities