---
id: CVE-2026-112291
title: >-
  Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing
  Authorization via Task API
summary: >-
  Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication
  and admin checks on the TaskResource index endpoint, allowing unauthenticated
  information disclosure. Remote attackers can send GET requests to
  /api/extension…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Flarum
product: Extension Manager
affected:
  - extension_manager >= 2.0.0-beta.1 < 2.0.0-beta.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T14:18:04.166860Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T14:18:17.505Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112291'
references:
  - url: 'https://github.com/flarum/framework/issues/4386'
  - url: >-
      https://github.com/flarum/framework/commit/257989e71fd8cc7ddab20f31dcde1aa760b1a08f
  - url: 'https://github.com/flarum/framework/releases/tag/v2.0.0-beta.8'
    label: Flarum v2.0.0-beta.8 Release Notes
  - url: >-
      https://github.com/flarum/framework/blob/v2.0.0-beta.6/extensions/package-manager/src/Api/Resource/TaskResource.php
  - url: >-
      https://www.vulncheck.com/advisories/flarum-extension-manager-2.0.0-beta.1-before-2.0.0-beta.8-missing-authorization-via-task-api
    label: >-
      VulnCheck Advisory: Flarum Extension Manager 2.0.0-beta.1 before
      2.0.0-beta.8 Missing Authorization via Task API
tags:
  - cve.org
ingestedAt: '2026-10-19T14:30:01.062Z'
---

## Overview

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version.

## Affected

- `extension_manager >= 2.0.0-beta.1 < 2.0.0-beta.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.