CVE-2026-46362 phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check
Authenticated attackers can bypass permission checks to access protected admin pages, exposing logs, user data, and system configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46362?
CVE-2026-46362 is a high-severity missing authorization vulnerability in thorsten phpmyfaq, published on 15 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.
Weakness: CWE-863
Which versions are affected by CVE-2026-46362?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | All versions | 4.1.2 |
thorsten/phpmyfaq Packagist | All versions | 4.1.2 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.2 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.2 |
How do I fix CVE-2026-46362?
Upgrade thorsten/phpmyfaq to 4.1.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-46362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46362 exists.
Sources
Also known as GHSA-hpgw-ww76-c68r.