Live › vulnerability › CVE-2026-112291
Go to dashboardFlarum Extension Manager 2.0.0-beta.1 through earlier beta builds skip authentication and admin checks on its task listing endpoint. A remote attacker can read filesystem paths, installed extensions, their versions and the PHP version.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Flarum with the Extension Manager extension in the affected beta range are exposed, because the task endpoint answers any anonymous HTTP GET. Forums without this extension installed, or running or later, are not affected.
2.0.0-beta.8No product ranges from the sources yet.
composer show flarum/extension-manager and confirm whether it is 2.0.0-beta.1 or a later beta below 2.0.0-beta.8./api/extension-manager-tasks from outside the network without logging in and see whether a JSON task list is returned.2.0.0-beta.8 or later with composer update flarum/extension-manager./api/extension-manager-tasks at the web server or reverse proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.
This page as .md · .json · in your agent: get_signal("CVE-2026-112291")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.