Missing Permission Checks in phpMyFAQ Configuration API Expose Sensitive Data

CVE-2026-45007

What is CVE-2026-45007?

In versions of phpMyFAQ prior to 4.1.2, the ConfigurationTabController.php contains a flaw where 12 API endpoints fail to enforce proper permission checks. Instead of verifying user permissions with 'userHasPermission(CONFIGURATION_EDIT)', authentication is falsely relied upon through 'userIsAuthenticated()'. This oversight permits any authenticated user to query sensitive configuration information from the /admin/api/configuration endpoints, including details about the permission model, cache backend, mail provider, and translation settings. This weakness results in a breach of the principle of least privilege, exposing critical system configuration data potentially exploitable by malicious actors.

References