CVE-2026-112291
Received Received - Intake

Unauthenticated Information Disclosure in Flarum Extension Manager

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112291
EUVD
EUVD-2026-104282

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Flarum Extension Manager 2.0.0-beta.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Flarum Extension Manager versions 2.0.0-beta.1 to 2.0.0-beta.7 have an issue where the TaskResource index endpoint does not require authentication or admin checks. This allows unauthenticated users to access sensitive information by sending GET requests to /api/extension-manager-tasks. The exposed data includes filesystem paths, installed extensions, their versions, and the PHP version.

Detection Guidance

To detect this vulnerability, check if unauthenticated GET requests to /api/extension-manager-tasks return task output containing filesystem paths, installed extensions, versions, or PHP version. Use tools like curl to send a GET request to the endpoint and inspect the response for sensitive data.

Impact Analysis

An attacker could exploit this to gather detailed information about your Flarum installation. This includes knowing which extensions are installed and their versions, which may help in identifying other vulnerabilities to exploit. It also reveals the PHP version, which could be used to target known PHP vulnerabilities.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive system information. GDPR requires protecting personal data, and HIPAA requires safeguarding protected health information. Unauthorized access to system details may violate these regulations if it leads to further data breaches or unauthorized access.

Mitigation Strategies

Immediately update Flarum Extension Manager to version 2.0.0-beta.8 or later to address the lack of authentication and admin checks. Ensure all API endpoints are properly secured and restrict access to sensitive endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112291. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart