CVE-2026-102247 FastAdmin Database Management database.php unnecessary privileges
Remote attackers can exploit unnecessary privileges in FastAdmin's database management to escalate privileges and potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-102247?
CVE-2026-102247 is a high-severity vulnerability in FastAdmin, published on 29 Sep 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit is now public and may be used.
Weakness: CWE-250
Which versions are affected by CVE-2026-102247?
How do I fix CVE-2026-102247?
No fix has been published for CVE-2026-102247 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102247 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102247 exists.
Sources
Also known as GHSA-jchq-r8m9-6xgq.