CVE-2026-2898

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2898", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-20T18:56:52.541Z", "datePublished": "2026-02-22T00:02:10.909Z", "dateUpdated": "2026-02-23T19:17:18.513Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-22T00:02:10.909Z"}, "title": "funadmin Backend Endpoint AuthCloudService.php getMember deserialization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "Deserialization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "Improper Input Validation"}]}], "affected": [{"vendor": "n/a", "product": "funadmin", "versions": [{"version": "7.1.0-rc1", "status": "affected"}, {"version": "7.1.0-rc2", "status": "affected"}, {"version": "7.1.0-rc3", "status": "affected"}, {"version": "7.1.0-rc4", "status": "affected"}], "cpes": ["cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*"], "modules": ["Backend Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-20T20:02:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "I4m6da (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347209", "name": "VDB-347209 | funadmin Backend Endpoint AuthCloudService.php getMember deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347209", "name": "VDB-347209 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753976", "name": "Submit #753976 | funadmin v7.1.0-rc4 Deserialization of Untrusted Data", "tags": ["third-party-advisory"]}, {"url": "https://github.com/I4m6da/CVE/issues/5", "tags": ["issue-tracking"]}, {"url": "https://github.com/I4m6da/CVE/issues/5#issue-3890444166", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T19:15:34.971727Z", "id": "CVE-2026-2898", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:17:18.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2898", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T19:15:34.971727Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T19:17:01.434Z"}}], "cna": {"title": "funadmin Backend Endpoint AuthCloudService.php getMember deserialization", "credits": [{"lang": "en", "type": "reporter", "value": "I4m6da (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Backend Endpoint"], "product": "funadmin", "versions": [{"status": "affected", "version": "7.1.0-rc1"}, {"status": "affected", "version": "7.1.0-rc2"}, {"status": "affected", "version": "7.1.0-rc3"}, {"status": "affected", "version": "7.1.0-rc4"}]}], "timeline": [{"lang": "en", "time": "2026-02-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-20T20:02:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347209", "name": "VDB-347209 | funadmin Backend Endpoint AuthCloudService.php getMember deserialization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347209", "name": "VDB-347209 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.753976", "name": "Submit #753976 | funadmin v7.1.0-rc4 Deserialization of Untrusted Data", "tags": ["third-party-advisory"]}, {"url": "https://github.com/I4m6da/CVE/issues/5", "tags": ["issue-tracking"]}, {"url": "https://github.com/I4m6da/CVE/issues/5#issue-3890444166", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-22T00:02:10.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2898", "state": "PUBLISHED", "dateUpdated": "2026-02-23T19:17:18.513Z", "dateReserved": "2026-02-20T18:56:52.541Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-22T00:02:10.909Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*"], "modules": ["Backend Endpoint"], "product": "funadmin", "vendor": "n/a", "versions": [{"status": "affected", "version": "7.1.0-rc1"}, {"status": "affected", "version": "7.1.0-rc2"}, {"status": "affected", "version": "7.1.0-rc3"}, {"status": "affected", "version": "7.1.0-rc4"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:funadmin:funadmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "67A1D507-8F8E-4C10-B5CB-D08DE081AF77", "versionEndExcluding": "7.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "D14B5D13-CC64-43DE-A709-150D9284D19C", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "2BF7A984-32FB-4957-8151-47FC4C2CB9CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "518EE1E1-CD85-4784-94E5-D7DF735BFF56", "vulnerable": true}, {"criteria": "cpe:2.3:a:funadmin:funadmin:7.1.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "303D805A-EEC2-44FE-BB54-8B336EA8A3E7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in funadmin up to 7.1.0-rc4. This issue affects the function getMember of the file app/common/service/AuthCloudService.php of the component Backend Endpoint. The manipulation of the argument cloud_account results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en funadmin hasta 7.1.0-rc4. El problema afecta a la funci\u00f3n getMember del archivo app/common/service/AuthCloudService.php del componente Backend Endpoint. Al manipular el argumento cloud_account se puede realizar una deserializaci\u00f3n. El ataque puede ser realizado en remoto. El exploit es ahora p\u00fablico y puede ser utilizado. El proveedor fue contactado con anterioridad sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2898", "lastModified": "2026-06-17T10:31:59.710", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2898", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T19:15:34.971727Z", "version": "2.0.3"}}]}, "published": "2026-02-22T01:16:00.350", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/I4m6da/CVE/issues/5"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/I4m6da/CVE/issues/5#issue-3890444166"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347209"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347209"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.753976"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.1.0-rc4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "funadmin", "source": "cna", "vendor": "n/a"}, "product": "funadmin", "vendor": "funadmin"}], "analysis": {"en": {"generated_at": "2026-04-17T16:39:26.937514+00:00", "value": {"mitigation_remediation": ["Apply an official patch or upgrade to a fixed FunAdmin release once available.", "Restrict network traffic to the AuthCloudService.php endpoint to trusted hosts only, limiting exposure to remote attackers.", "Reject or whitelist permissible object types during deserialization of the cloud_account parameter to eliminate unchecked object instantiation."], "summary": {"action": "Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the FunAdmin application, specifically all releases up to version 7.1.0\u2011rc4. The affected releases include rc1, rc2, rc3, and rc4 of the 7.1.0 branch. No other versions or products are listed as impacted.", "description_and_impact": "The flaw is a remote deserialization vulnerability in the getMember function of AuthCloudService.php. By manipulating the cloud_account argument, an attacker can force the application to unserialize crafted data, which can lead to execution of arbitrary code with the permissions of the web server process. The CVE description explicitly states the exploit can originate from outside the host, indicating an exploitation path that targets the backend endpoint directly.", "risk_and_exploitability": "The CVSS score of 5.1 reflects moderate severity, while the EPSS score of less than 1% signifies a low probability of exploitation in the current threat landscape. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the CVE description, the attack can be launched remotely by manipulating the cloud_account parameter sent to the backend endpoint, suggesting a web\u2011based attack vector that does not require privilege escalation or local access."}}}}, "created": "2026-02-23T14:29:50.179493+00:00", "updated": "2026-04-17T16:45:15.828697+00:00", "vendors": ["funadmin", "funadmin$PRODUCT$funadmin"]}