Information Disclosure in phpMyFAQ Product by phpMyFAQ

CVE-2026-111904

What is CVE-2026-111904?

The phpMyFAQ application versions before 4.2.0-beta are susceptible to an information disclosure vulnerability. An error in the api.onlyPublicQuestions check within the OpenQuestionController allows unauthenticated users to exploit this flaw. By sending GET requests to the /api/v4.0/open-questions endpoint, attackers can access hidden open questions, including non-public moderation and internal queries along with their associated usernames. This exposure can lead to unauthorized retrieval of sensitive information.

References