{"id":"CVE-2026-112291","summary":"Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API","details":"Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.","modified":"2026-10-21T02:55:51.101555809Z","published":"2026-10-19T13:55:33.404Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112291.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112291.json"},{"type":"PACKAGE","url":"https://github.com/flarum/framework"},{"type":"ARTICLE","url":"https://github.com/flarum/framework/blob/v2.0.0-beta.6/extensions/package-manager/src/Api/Resource/TaskResource.php"},{"type":"FIX","url":"https://github.com/flarum/framework/commit/257989e71fd8cc7ddab20f31dcde1aa760b1a08f"},{"type":"REPORT","url":"https://github.com/flarum/framework/issues/4386"},{"type":"ADVISORY","url":"https://github.com/flarum/framework/releases/tag/v2.0.0-beta.8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112291"},{"type":"WEB","url":"https://packagist.org"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/flarum-extension-manager-2.0.0-beta.1-before-2.0.0-beta.8-missing-authorization-via-task-api"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/flarum/framework","events":[{"introduced":"382991648c9db5d5e17476b55e4f9fe1cac1ea08"},{"fixed":"d4963509d9bc521d34ca35c9ea40ae0dd927db72"},{"fixed":"257989e71fd8cc7ddab20f31dcde1aa760b1a08f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.0.0-beta.1"},{"fixed":"2.0.0-beta.8"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"257989e71fd8cc7ddab20f31dcde1aa760b1a08f"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v2.0.0-beta.8","range":[{"fixed":"d4963509d9bc521d34ca35c9ea40ae0dd927db72"}],"source":"REFERENCES_TAG"}]}}],"versions":["v2.0.0-beta.6","v2.0.0-beta.5","v2.0.0-beta.4","v2.0.0-beta.3","v2.0.0-beta.2","v2.0.0-beta.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112291.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}