GitHub Advisoryadvisory · Packagist

GHSA-gcxp-xg77-798j funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function

LOW Published 2026-02-22 Modified 2026-02-26 Official page ↗
Aliases
CVE-2026-2898
Ecosystem
Packagist
Packages
funadmin/funadmin
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-20, CWE-502
Reviewed
2026-02-26

Affected packages

• Packagist funadmin/funadmin: <= 7.1.0-rc4 (no fix yet)

Description

A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-2898 A vulnerability was detected in funadmin up to 7.1.0-rc4. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References