CVE-2026-45009 describes an insufficient authorization vulnerability in phpMyFAQ prior to version 4.1.2. The flaw exists in the admin-api routes where the application verifies only that a user is logged in, but does not properly check if the user has administrative privileges. As a result, authenticated users with ordinary frontend accounts can access sensitive backend operational data including dashboard versions, LDAP configuration details, Elasticsearch statistics, and health-check information. This exposure could aid attackers in reconnaissance but does not directly impact data integrity or availability.

The vulnerability allows authenticated non-administrative users to access sensitive backend operational information that should be restricted. This information disclosure could facilitate further attacks or reconnaissance but does not directly allow modification or disruption of the system. The CVSS score of 4.3 reflects a medium impact primarily due to confidentiality loss without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to phpMyFAQ to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary frontend user accounts. Follow vendor communications closely for updates on patches or official mitigations.