CVE-2026-2896

Name of the Vulnerable Software and Affected Versions funadmin versions up to 7.1.0-rc4

Description A weakness exists in funadmin that could lead to improper authorization. This is due to a manipulation possible in the setConfig function within the app/backend/controller/Ajax.php file of the Configuration Handler component. The attack can be executed remotely. The exploit has been made publicly available. The vendor was contacted but did not respond.

Recommendations Update funadmin to a version later than 7.1.0-rc4.