CVE-2026-112291: Missing Authorization in Flarum Extension Manager

The Flarum Extension Manager from version 2.0.0-beta.1 up to but not including 2.0.0-beta.8 lacks proper authentication and administrative checks on its TaskResource index endpoint. This missing authorization permits unauthenticated attackers to retrieve task output data by sending GET requests to the /api/extension-manager-tasks endpoint. The disclosed information includes filesystem paths, details of installed extensions, their versions, and the PHP version running on the server. This information disclosure vulnerability could aid attackers in further reconnaissance but does not directly allow modification or execution of code.

Unauthenticated remote attackers can access sensitive internal information about the server environment and installed software components. Disclosure of filesystem paths, installed extensions, and PHP version may facilitate further targeted attacks or exploitation by providing attackers with valuable reconnaissance data. There is no indication of direct code execution or privilege escalation from this vulnerability alone.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/extension-manager-tasks endpoint to authorized users only, for example by network-level controls or web application firewall rules.