Read the docs
TI-2026-76491 Aliases CVE-2026-112291GHSA-6p4m-p9g8-5x3c

Missing authorization in Flarum Extension Manager task API exposes data

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Flarum Extension Manager from 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on its task list endpoint, classified as CWE-862. An unauthenticated remote attacker can send GET requests to the task API and read task output that reveals filesystem paths, installed extensions, versions and the PHP version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed Extension Manager (Flarum): 2.0.0-beta.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
flarumExtension Manager2.0.0-beta.1 to before 2.0.0-beta.82.0.0-beta.8Patch availableCNA
  • Extension Manager Vendorflarum Affected 2.0.0-beta.1 to before 2.0.0-beta.8 Fixed in 2.0.0-beta.8 Patch available CNA

Remediation

Update Flarum Extension Manager to 2.0.0-beta.8, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Extension Manager (Flarum) Fixed in 2.0.0-beta.8

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112291
  2. 2026-10-19 Alias added: GHSA-6p4m-p9g8-5x3c

References

Patch 1

Other 3

  • TI-2021-12339 XSS vulnerability with translator CVSS 3.1CRITICAL 10.0
  • TI-2023-08736 Post mentions can be used to read any post on the forum without access control CVSS 3.1HIGH 7.7
  • TI-2025-20573 Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite CVSS 3.1MEDIUM 6.8
  • TI-2026-30290 Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577) CVSS 3.1MEDIUM 4.9
  • TI-2026-23739 flarum/nickname: Display name injection in notification emails (autolink & markdown) CVSS 3.1MEDIUM 4.6
  • TI-2026-28792 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset CVSS 4.0CRITICAL 9.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences