{"id":"CVE-2026-112291","kind":"vulnerability","aliases":["CVE-2026-112291"],"related":[],"title":"Flarum Extension Manager leaks task output to unauthenticated internet visitors","description":"Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.","summary":"Flarum Extension Manager 2.0.0-beta.1 through earlier beta builds skip authentication and admin checks on its task listing endpoint. A remote attacker can read filesystem paths, installed extensions, their versions and the PHP version.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flarum","package","php","self-hosted"],"not_affected_if":["beta.8-or-later","extension-not-installed"],"how_to_check":"- Check the installed version of the Flarum Extension Manager extension with `composer show flarum/extension-manager` and confirm whether it is `2.0.0-beta.1` or a later beta below `2.0.0-beta.8`.\n- Request `/api/extension-manager-tasks` from outside the network without logging in and see whether a JSON task list is returned.","fix":"- Upgrade the Flarum Extension Manager extension to `2.0.0-beta.8` or later with `composer update flarum/extension-manager`.\n- Until upgraded, block `/api/extension-manager-tasks` at the web server or reverse proxy.","status":"open","published_at":"2026-10-19T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:40:47+00:00","updated_at":"2026-10-25T03:40:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:40:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Flarum Extension Manager extension to `2.0.0-beta.8` or later with `composer update flarum/extension-manager`.\n- Until upgraded, block `/api/extension-manager-tasks` at the web server or reverse proxy.","reach":"internet","title":"Flarum Extension Manager leaks task output to unauthenticated internet visitors","impact":"low","summary":"Flarum Extension Manager 2.0.0-beta.1 through earlier beta builds skip authentication and admin checks on its task listing endpoint. A remote attacker can read filesystem paths, installed extensions, their versions and the PHP version.","category":"package","nicknames":[],"who_cares":["flarum","self-hosted","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous visitors read server paths, installed extensions and PHP version.","analyst_note":"","how_to_check":"- Check the installed version of the Flarum Extension Manager extension with `composer show flarum/extension-manager` and confirm whether it is `2.0.0-beta.1` or a later beta below `2.0.0-beta.8`.\n- Request `/api/extension-manager-tasks` from outside the network without logging in and see whether a JSON task list is returned.","needs_analyst":false,"not_affected_if":["extension-not-installed","beta.8-or-later"],"who_is_affected":"Sites running Flarum with the Extension Manager extension in the affected beta range are exposed, because the task endpoint answers any anonymous HTTP GET. Forums without this extension installed, or running `2.0.0-beta.8` or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3362,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112291':13A,16A '-2026':12A,15A '/api/extension-manager-tasks':86C '2.0.0':26B,60C,63C 'admin':35B,68C 'allow':75C 'attack':44B,80C 'authent':33B,66C 'beta':30B 'beta.1':27B,61C 'beta.8':64C 'build':31B 'check':36B,69C 'cve':11A,14A 'disclosur':78C 'earlier':29B 'endpoint':41B,74C 'extens':2A,24B,50B,58C,95C 'filesystem':47B,92C 'flarum':1A,17B,23B,57C 'get':83C 'host':22B 'index':73C 'inform':77C 'instal':49B,94C 'internet':9A 'lack':65C 'leak':4A 'list':40B 'manag':3A,25B,59C 'output':6A,90C 'packag':18B 'path':48B,93C 'php':19B,55B,98C 'read':46B,88C 'remot':43B,79C 'request':84C 'reveal':91C 'self':21B 'self-host':20B 'send':82C 'skip':32B 'task':5A,39B,89C 'taskresourc':72C 'unauthent':8A,76C 'version':52B,56B,96C,99C 'visitor':10A","nicknames":[],"mitigations":[],"who_affected":"Sites running Flarum with the Extension Manager extension in the affected beta range are exposed, because the task endpoint answers any anonymous HTTP GET. Forums without this extension installed, or running `2.0.0-beta.8` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112291","severity":null,"published_at":"2026-10-19T14:17:07+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}