CVE-2026-2896

An attacker can remotely exploit a vulnerability in funadmin to manipulate user account data, potentially allowing them to execute harmful code on the server. This issue affects versions up to 7.1.0-rc4 and arises from improper handling of input in the authentication service.

This vulnerability allows an attacker to inject malicious scripts into the backend interface of the funadmin application, potentially compromising user data or session information. It can be exploited remotely without needing special access, making it a significant risk for users running affected versions up to 7.1.0-rc4.

An attacker can exploit a weakness in the password recovery process of funadmin to potentially reset user passwords and gain unauthorized access to accounts. This requires the attacker to manipulate specific recovery codes, and while the method is complex and difficult, public information about the exploit is now available, increasing the risk of attacks.

This vulnerability allows an attacker to remotely access sensitive information from the funadmin application, specifically through a function related to password recovery. The issue affects versions up to 7.1.0-rc4, and there is already a publicly available exploit that could be used to take advantage of this flaw.