CVE-2026-2894

funadmin forget.html getMember information disclosure

View on CVE.org
Published Feb 21, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability allows an unauthenticated attacker to invoke the getMember function through the funadmin login/forget.html page and retrieve sensitive member information. This represents a direct exposure of data that should be protected, classified under CWE-200 and CWE-284.

Affected Systems

All installations of funadmin up to and including version 7.1.0-rc4 are affected. The impact is limited to the funadmin product; no other vendors or products are listed.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity vulnerability and the EPSS score of less than 1% suggests a low exploitation probability at the time of analysis. The vulnerability can be triggered remotely, and publicly available exploits exist, but it is not currently recorded in CISA’s KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest funadmin release that contains the fix, such as version 7.1.1 or later.
  • If an immediate upgrade is not possible, restrict network access to the /app/frontend/view/login/forget.html endpoint or enforce authentication before allowing requests to the getMember function.
  • Monitor authentication and member lookup logs for anomalous activity and investigate any suspicious traffic to the getMember endpoint.

Generated by OpenCVE AI on April 17, 2026 at 16:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-8hhx-xq9j-xwfj funadmin exposes sensitive information via getMember function
History
Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:funadmin:funadmin:7.1.0:rc1:*:*:*:*:*:*
cpe:2.3:a:funadmin:funadmin:7.1.0:rc2:*:*:*:*:*:*
cpe:2.3:a:funadmin:funadmin:7.1.0:rc3:*:*:*:*:*:*
cpe:2.3:a:funadmin:funadmin:7.1.0:rc4:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in funadmin up to 7.1.0-rc4. Affected by this vulnerability is the function getMember of the file app/frontend/view/login/forget.html. Such manipulation leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title funadmin forget.html getMember information disclosure
First Time appeared Funadmin
Funadmin funadmin
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*
Vendors & Products Funadmin
Funadmin funadmin
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Feb 23, 2026, 7:28 PM
Reserved
Feb 20, 2026, 6:56 PM

View source JSON

Updated
Feb 23, 2026, 7:28 PM

JSON

Status
Analyzed
Published
Feb 21, 2026, 11:15 PM
Modified
Jun 17, 2026, 10:31 AM

View source JSON

No data.

Updated
Apr 17, 2026, 4:45 PM

JSON