CVE-2026-2898 | funadmin up to 7.1.0-rc4 Backend Endpoint AuthCloudService.php getMember cloud_account deserialization

A vulnerability categorized as problematic has been discovered in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization.

This vulnerability was named CVE-2026-2898. The attack may be performed from remote. In addition, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.