Skip to content
OpenAdvisories
High · 7.1 CVE-2026-25233 EUVD-2026-5202

PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

Published Feb 3, 2026 · Updated Feb 4, 2026 · Assigned by GitHub_M

Description

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.

Affected products

VendorProductAffectedFixed
pear pearweb < 1.33.0 —

References