CVE-2026-2894: 
PHP vulnerability analysis and mitigation

CVE-2026-2894 is an information disclosure vulnerability affecting funadmin up to version 7.1.0-rc4, including release candidates rc1 through rc4. The flaw resides in the getMember function within app/frontend/view/login/forget.html, allowing unauthenticated remote attackers to access sensitive user data. It was published on February 21, 2026, with the vendor contacted prior to disclosure but receiving no response. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 5.5 (Medium) (Feedly, VulDB).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-284 (Improper Access Control), indicating that the getMember function in the password-reset/forget page fails to enforce proper authorization checks before returning member data. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. Proof-of-concept exploit code has been publicly disclosed on GitHub (GitHub PoC).

Successful exploitation allows an unauthenticated remote attacker to disclose sensitive user information stored or processed by the getMember function, posing a high confidentiality and integrity risk. The CVSS v3.1 scoring reflects high confidentiality and integrity impact with no availability impact, meaning attackers can read and potentially manipulate user data without disrupting service availability. Depending on the data exposed (e.g., user credentials, personal information), this could facilitate account takeover or further targeted attacks (Feedly).

Proof-of-concept exploits are publicly available on GitHub, published around February 24, 2026 (GitHub PoC). The CVSS v4.0 exploit maturity is rated as "Proof of Concept," and no evidence of active in-the-wild exploitation has been observed as of the latest intelligence update. The EPSS score is approximately 0.032% (0.000320), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify internet-facing funadmin instances (versions up to 7.1.0-rc4) using search engines like Shodan or Censys, or by fingerprinting the application's login/forget page.
2. Locate the vulnerable endpoint: Navigate to or send an HTTP request targeting the app/frontend/view/login/forget.html endpoint, which hosts the vulnerable getMember function.
3. Craft the exploit request: Send a crafted HTTP request (GET or POST, as indicated by the PoC) to the forget password endpoint with parameters designed to invoke getMember without valid authentication or authorization tokens.
4. Extract sensitive data: Parse the server's response, which improperly returns sensitive member/user information due to the missing access control check.
5. Leverage disclosed data: Use extracted credentials, email addresses, or other user data for account takeover, credential stuffing, or further targeted attacks (GitHub PoC).

• Network: Unusual or repeated HTTP requests to /app/frontend/view/login/forget.html from unknown or external IP addresses, particularly with parameters invoking getMember.
• Logs: Web server access logs showing high-frequency or automated requests to the forget-password endpoint without corresponding legitimate user sessions; responses with unexpectedly large payloads from this endpoint.
• Logs: Authentication logs showing access to member data endpoints without prior authenticated sessions.
• Process/Application: Unexpected data returned in responses from the getMember function visible in application debug or error logs.

No official patch is currently available, as the vendor has not responded to disclosure attempts (Feedly). Recommended compensating controls include: (1) implementing network-level access controls or firewall rules to restrict access to funadmin instances to trusted IP ranges; (2) deploying Web Application Firewall (WAF) rules to block or alert on requests targeting the login/forget.html endpoint with suspicious parameters; (3) enhancing logging and monitoring of authentication-related endpoints for anomalous access patterns; and (4) evaluating migration to alternative or patched forks of funadmin until an official fix is released.

The vulnerability has been indexed by multiple security aggregators including VulDB, CIRCL, INCIBE-CERT, and Offseq Radar shortly after publication, reflecting routine community tracking of newly disclosed CVEs. No notable vendor statements, prominent researcher commentary, or significant media coverage beyond standard aggregation has been identified for this vulnerability.