CVE-2026-45007 is a medium-severity vulnerability in phpMyFAQ prior to version 4.1.2. The issue arises from missing permission checks in ConfigurationTabController.php, where 12 endpoints use userIsAuthenticated() rather than userHasPermission(CONFIGURATION_EDIT). Consequently, any authenticated user can enumerate system configuration details such as the permission model, cache backend, mail provider, and translation provider by querying the /admin/api/configuration endpoints. This improper authorization bypass leads to exposure of sensitive configuration metadata.

The vulnerability allows any authenticated user to access sensitive system configuration metadata that should be restricted to users with configuration edit permissions. This exposure could aid an attacker in understanding system internals and potentially facilitate further attacks. However, it does not allow modification or denial of service, and the CVSS score is 4.3 (medium severity) reflecting limited confidentiality impact and no integrity or availability impact.

No official patch or remediation level is currently documented. Users should upgrade to phpMyFAQ version 4.1.2 or later once available, as the vulnerability affects versions before 4.1.2. Until then, restrict access to the /admin/api/configuration endpoints to trusted users only and monitor authenticated user activity closely. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.