CVE-2026-112291 in Extension Manager
Summary
by MITRE • 10/19/2026
Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Flarum Extension Manager prior to version 2.0.0-beta.8 represents a critical failure in access control mechanisms within the application's API layer. Specifically, the TaskResource index endpoint, which is accessible via GET requests to /api/extension-manager-tasks, was implemented without enforcing authentication or administrative privilege checks. This architectural oversight allows any remote actor with network connectivity to the target system to interact directly with this endpoint. The flaw stems from a misconfiguration in the routing and middleware layers of the Flarum framework integration, where sensitive management functions were exposed publicly rather than being restricted to authenticated administrators who manage extensions for the forum software.
From a technical perspective, the absence of authentication checks means that the server processes requests without verifying the identity or permissions of the caller. When an unauthenticated user sends a GET request to this endpoint, the backend executes logic intended only for privileged users and returns detailed diagnostic information about the system's state. This includes specific filesystem paths where files are stored, a list of all installed extensions along with their respective version numbers, and details regarding the PHP runtime environment in which Flarum is operating. Such data aggregation provides an attacker with significant reconnaissance capabilities, effectively turning the application into an information disclosure vector that reveals internal infrastructure details without any barrier to entry.
The operational impact of this vulnerability extends beyond simple curiosity-driven enumeration. The disclosed filesystem paths can aid attackers in identifying potential targets for further exploitation, such as locating configuration files or backup directories if other vulnerabilities exist. Knowledge of installed extensions and their versions allows adversaries to cross-reference known CVEs associated with specific extension releases, facilitating targeted attacks against outdated components. Furthermore, revealing the PHP version helps in crafting exploits that leverage known weaknesses in older or unsupported PHP releases. This level of information leakage significantly lowers the barrier for subsequent attack phases, including privilege escalation, remote code execution attempts, and denial-of-service planning by providing a precise map of the application's technology stack and dependencies.
This issue aligns with CWE-200: Information Exposure, as it involves the unintentional disclosure of sensitive system data to unauthorized parties. It also maps to MITRE ATT&CK technique T1592.004: Gather Victim Host Information - Software, where attackers collect details about software installed on a victim's machine or server to identify potential vulnerabilities for exploitation. The lack of proper access control mechanisms reflects CWE-862: Missing Authorization, highlighting the fundamental security principle that every request must be validated against user permissions before processing sensitive data.
To mitigate this vulnerability, organizations running Flarum with Extension Manager versions prior to 2.0.0-beta.8 should immediately upgrade to version 2.0.0-beta.8 or later, where these authentication and authorization checks have been properly implemented. Until an update can be applied, administrators may consider implementing a web application firewall rule to block access to the /api/extension-manager-tasks endpoint from untrusted IP addresses or restricting API access entirely if not required for external integrations. Regular security audits of custom extensions are also recommended to ensure that no other endpoints suffer from similar misconfigurations, thereby maintaining a robust defense-in-depth posture against information disclosure attacks.