CVE-2026-46362 is an authorization bypass vulnerability in phpMyFAQ prior to version 4.1.2. The issue lies in the AbstractAdministrationController::userHasPermission() method, which fails to terminate execution after issuing a forbidden response. As a result, authenticated users with limited privileges can access all admin pages that should be permission-protected. This exposure includes sensitive administrative data and system information. The vulnerability does not affect availability or integrity but has a high impact on confidentiality. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows authenticated users with limited privileges to bypass authorization controls and access all admin pages. This leads to exposure of sensitive information such as administrative logs, user data, system information, and application configuration. The confidentiality of the system is compromised, but integrity and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity. Avoid granting unnecessary privileges to users. Follow vendor updates closely to apply any forthcoming patches or official mitigations.