GitHub Security Advisory: GHSA-hpgw-ww76-c68r
Package: thorsten/phpmyfaq (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 4.1.1
Patched in: 4.1.2

Summary: phpMyFAQ has an Authorization Bypass in All Admin Pages Due to Non-Terminating Permission Check

Details:
## Summary

`AbstractAdministrationController::userHasPermission()` catches the `ForbiddenException` thrown when a user lacks a specific permission, sends a "forbidden" HTML page via `$response->send()`, but does not terminate execution. The calling controller method continues to execute, fetches protected data, renders the full template, and returns it as a Response. The final `$response->send()` in `admin/index.php` outputs the protected page content after the forbidden page, leaking all permission-protected admin data to any authenticated admin user regardless of their actual permissions.

## Details

The parent class `AbstractController::userHasPermission()` (`phpmyfaq/src/phpMyFAQ/Controller/AbstractController.php:317-327`) correctly enforces authorization by throwing a `ForbiddenException` when the user lacks the required permission. This exception would normally propagate to Symfony's HttpKernel exception handler, which would return an error response and prevent the controller from continuing.

However, `AbstractAdministrationController` overrides this method at line 390-399:

```php
#[\Override]
protected function userHasPermission(PermissionType $permissionType): void
{
    try {
        parent::userHasPermission($permissionType);
    } catch (ForbiddenException $exception) {
        $response = $this->getForbiddenPage($exception->getMessage());
        $response->send();  // Outputs HTML but does NOT terminate execution
    } catch (Exception $exception) {
        $this->configuration->getLogger()->error($exception->getMessage());
        // Only logs, no response, no termination
    }
}
```

The critical flaw: after `$response->send()` at line 396, there is no `exit()`, `die()`, `return`, or re-throw. PHP execution continues normally into the calling controller method.

For example, in `AdminLogController::index()` (`phpmyfaq/src/phpMyFAQ/Controller/Administration/AdminLogController.php:45-83`):

```php
public function index(Request $request): Response
{
    $this->userHasPermission(PermissionType::STATISTICS_ADMINLOG);
    // ^^^ If user lacks permission: forbidden page is echoed, but execution continues

    // ... all of this still executes:
    $loggingData = $this->adminLog->getAll();  // Fetches ALL admin log entries
    // ...
    return $this->render('@admin/statistics/admin-log.twig', [
        // ... full admin log data including IPs, usernames, actions
        'loggingData' => $currentItems,
    ]);
}
```

The entry point `admin/index.php` then calls `$response->send()` on the returned Response, appending the full protected page to the already-sent forbidden page in the HTTP response body.

The second `catch` block (line 397-398) for generic `Exception` is even worse — it only logs the error without sending any response or terminating, so the protected page renders with no forbidden notice at all.

**58 admin controllers** extend `AbstractAdministrationController` and call `userHasPermission()`, meaning every permission-prot