The vulnerability is an unauthorized access flaw in the Flarum Extension Manager's TaskResource index. A remote attacker can send an unauthenticated GET request to the /api/extension-manager-tasks endpoint, causing the application to return detailed task output. The disclosed data includes filesystem paths, a list of installed extensions, their versions, and the PHP runtime version. This disclosure is governed by the authorization weakness identified as CWE‑862.

Affected are installations of Flarum Extension Manager version 2.0.0‑beta.1 through 2.0.0‑beta.7. The flaw was present in all releases prior to 2.0.0‑beta.8, which addressed the missing authentication checks.

The CVSS score for this vulnerability is 6.9, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not known to be actively exploited in the wild. The attack vector is remote, leveraging an unauthenticated HTTP GET request over the network. Because the disclosure includes internal paths and version information, an attacker can bootstrap further reconnaissance before attempting other attacks.