CVE-2026-112291

The Flarum Extension Manager version 2.0.0-beta.1 before 2.0.0-beta.8 is vulnerable to an unauthenticated information disclosure due to missing authorization and admin checks on the TaskResource index endpoint. Remote attackers can send GET requests to /api/extension-manager-tasks to retrieve tas...