CVE-2026-46362
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
May 15, 2026
Vendor
unknown
Description
phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after sending a forbidden response. Attackers can access all permission-protected admin pages by requesting their URLs as authenticated users, exposing admin logs, user data, system information, and application configuration.