GitHub Advisoryadvisory · Packagist

GHSA-8hhx-xq9j-xwfj funadmin exposes sensitive information via getMember function

MEDIUM Published 2026-02-22 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-2894
Ecosystem
Packagist
Packages
funadmin/funadmin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-02-26

Affected packages

• Packagist funadmin/funadmin: <= 7.1.0-rc4 (no fix yet)

Description

A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-2894 A vulnerability was identified in funadmin up to 7.1.0-rc4. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References