CVE-2026-2898: funadmin Deserialization Vulnerability in Backend Endpoint
Summary
CVE-2026-2898: funadmin: Deserialization Vulnerability in Backend Endpoint via AuthCloudService getMember Function. Affects funadmin/funadmin versions < 7.1.0-rc4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
funadmin is an open-source application designed for managing administrative tasks in various environments. It provides a backend service that interacts with cloud services for user management and authentication. The application is widely used due to its flexibility and ease of integration with other systems. However, versions up to 7.1.0-rc4 have been found to be vulnerable to a deserialization issue that can be exploited remotely, potentially compromising the integrity of the application.
Vulnerability Detail
A deserialization vulnerability exists in the funadmin package, specifically in the getMember function of the AuthCloudService.php file. This vulnerability arises from improper handling of the cloud_account argument, allowing an attacker to manipulate the input and execute arbitrary code. The implications of this vulnerability are significant, as it can lead to unauthorized access and control over the application, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the affected endpoint and validate inputs rigorously to prevent exploitation until the package can be updated. Implementing input sanitization can help mitigate the risk of deserialization attacks.
Conclusion
The deserialization vulnerability in funadmin poses a significant risk to users of the application. It is crucial to update to a patched version to mitigate potential attacks. Implementing workarounds can provide temporary relief, but a permanent fix through an update is strongly recommended.
See every vulnerability recorded for funadmin/funadmin →
FAQ
The vulnerability is a deserialization issue that allows remote attackers to manipulate input and potentially execute arbitrary code.
Versions of funadmin up to 7.1.0-rc4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, implement input validation and restrict access to the affected endpoint as a temporary measure.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for funadmin/funadmin.
