CVE-2026-2895: 
PHP vulnerability analysis and mitigation

CVE-2026-2895 is a weak password recovery vulnerability in funadmin up to version 7.1.0-rc4, classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The flaw resides in the repass function of app/frontend/controller/Member.php, where manipulation of the forget_code and vercode parameters allows attackers to bypass password recovery validation and reset user passwords without authorization. The vulnerability was published on February 21, 2026, and the vendor was contacted prior to disclosure but did not respond. It carries a CVSS v3.1 base score of 8.1 (High), though CVSS v4.0 rates it 2.9 (Low) due to limited direct impact scope (Feedly).

The root cause is CWE-640: Weak Password Recovery Mechanism for Forgotten Password, specifically in the repass function within app/frontend/controller/Member.php of the funadmin application. An attacker can remotely manipulate the forget_code and/or vercode parameters submitted during the password recovery flow to bypass server-side validation, effectively resetting a target user's password without possessing the legitimate recovery token. No authentication, user interaction, or elevated privileges are required, though the attack complexity is rated High, indicating that successful exploitation may require specific conditions or timing. A public proof-of-concept has been released on GitHub (Feedly, PoC).

Successful exploitation allows an unauthenticated remote attacker to reset arbitrary user account passwords, gaining unauthorized access to those accounts and enabling full account takeover. This compromises confidentiality, integrity, and availability of affected user accounts, as attackers can impersonate legitimate users, access sensitive data, and potentially escalate privileges within the application. The scope is limited to the funadmin application itself, but lateral movement within the application's data and functionality is possible depending on the privileges of the compromised account (Feedly).

A public proof-of-concept exploit has been published on GitHub (https://github.com/I4m6da/CVE/issues/2) as of February 24, 2026, widening the attack surface. As of the latest available data, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.03% (0.000300000), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, PoC).

1. Reconnaissance: Identify publicly accessible funadmin instances running versions up to 7.1.0-rc4 using web search engines or application fingerprinting tools.
2. Initiate password recovery: Navigate to the funadmin frontend password recovery page and trigger a password reset request for a target user account to observe the parameters used.
3. Intercept the request: Use a proxy tool (e.g., Burp Suite) to capture the HTTP request containing the forget_code and/or vercode parameters sent to the repass function in app/frontend/controller/Member.php.
4. Manipulate parameters: Modify the forget_code and/or vercode parameter values in the intercepted request to bypass server-side validation — for example, by supplying a predictable, empty, or crafted value that the weak validation logic accepts.
5. Reset target password: Submit the manipulated request; if successful, the server accepts the forged recovery token and allows the attacker to set a new password for the target account.
6. Account takeover: Log in to the target account using the newly set password, gaining full access to the account's data and privileges within the funadmin application (PoC, Feedly).

• Network: Unusual or repeated HTTP POST requests to the funadmin password recovery endpoint (e.g., paths involving Member.php or repass) from unexpected source IPs or at abnormal frequencies.
• Logs: Application logs showing multiple password reset attempts for the same or different accounts in a short time window; successful password resets not initiated by the legitimate account owner; requests with anomalous or empty forget_code/vercode parameter values.
• Application: Unexpected account password changes reported by users; login events from unfamiliar IP addresses following password reset activity.

No official patch has been released by the funadmin vendor, who did not respond to the researcher's disclosure. Organizations running funadmin up to version 7.1.0-rc4 should apply the following interim mitigations: implement multi-factor authentication or additional verification steps for the password recovery flow; add rate limiting and anomaly detection to password reset endpoints; enforce strong, unpredictable recovery token generation server-side; restrict access to the funadmin application to trusted networks where possible; and monitor application logs for suspicious password reset activity. Upgrade to a patched version once the vendor releases one (Feedly).

The vulnerability was noted by INCIBE-CERT (Spain's national cybersecurity incident response team) in their early warning alerts, and was tracked by Red Hat's CVE advisory system despite funadmin not being a Red Hat product. No significant vendor statement, notable researcher commentary, or broad media coverage has been identified beyond standard CVE aggregator reporting (Feedly).