CVE-2026-2894 is a medium severity (CVSS 5.3) information disclosure flaw in funadmin up to 7.1.0-rc4. A user-controllable cookie in the forgotten password view lets one user look up another's details. The record says the vendor did not respond and lists no fix.
What's affected
The record names funadmin up to 7.1.0-rc4. The affected function is getMember, used by app/frontend/view/login/forget.html.
The researcher's issue says that when the cookies forget_uid and forget_code are present, the page retrieves a username through getMember, and forget_uid is fully controlled by the user. The record says the vendor was contacted early and did not respond. No patched version is listed.
How to check if you're exposed
Check the version of funadmin in your deployment, from its release tag or version file, and compare it with 7.1.0-rc4. Look at the forgot password template to see whether it reads the cookie in the way the issue describes.
What to do now
- Inventory funadmin installs and versions.
- Limit access to the frontend login and reset pages if you cannot patch, for example with an allowlist or a web application firewall rule.
- Change the code so the reset flow looks up the user from a server side token, not from a cookie value the user can edit.
- Check logs for requests with unusual cookie values on the reset page.
- Watch the project for a fixed release.
Why it matters
The record lists CWE-200 (exposure of sensitive information) and CWE-284 (improper access control). The description in the researcher's issue is horizontal privilege escalation: a user can reach another user's data by changing an identifier that the server trusts.
That pattern, often called an insecure direct object reference, is common and avoidable. The server should decide who the user is from its own session or token, never from a value the browser sends back. The score is moderate because only limited information is exposed, but it is a useful starting point for account attacks. The record says the exploit is public and does not mark the CVE as exploited in the wild.
Quick check
Why is the score only medium?
The record scores confidentiality impact as low and lists no integrity or availability impact. The flaw reveals limited information, though that can aid other attacks.
Sources
Last reviewed: 19 October 2026.
