Information Disclosure Vulnerability in phpMyFAQ by phpMyFAQ Team

CVE-2026-76211

What is CVE-2026-76211?

The phpMyFAQ software, prior to version 4.1.7, presents a significant information disclosure flaw by failing to adequately enforce 'CONFIGURATION_EDIT' permissions on its admin API read endpoints. This lapse allows any authenticated user to gain unauthorized access to sensitive administrative information, which includes specifics about LDAP server topology and account names, along with crucial data related to Elasticsearch and OpenSearch configurations. By exploiting this vulnerability, attackers can leverage valid session tokens to call the affected endpoints, potentially revealing site analytics and index statistics, which can compromise overall security posture.

References