A vulnerability was found in funadmin up to 7.1.0-rc4. It has been declared as critical. This affects the function
setConfig of the file app/backend/controller/Ajax.php of the component Configuration Handler. Executing a manipulation can lead to improper authorization.
This vulnerability is handled as CVE-2026-2896. The attack can be executed remotely. Additionally, an exploit exists.
The vendor was contacted early about this disclosure but did not respond in any way.
