Information Disclosure Vulnerability in phpMyFAQ by phpMyFAQ Team
CVE-2026-76215

6.9MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76215?

The version of phpMyFAQ prior to 4.1.7 is susceptible to an information disclosure vulnerability. This flaw occurs when the application fails to enforce proper visibility checks for parent FAQs, allowing unauthenticated attackers to access restricted child resources such as comments and attachments. By exploiting insecure API endpoints, attackers can retrieve sensitive information, including comment texts, email addresses of commenters, and filenames of attachments associated with FAQs that they are not authorized to view. This vulnerability underscores the importance of implementing robust authorization checks in software applications.

Affected Version(s)

phpMyFAQ 0 < 4.1.7

phpMyFAQ 4.1.7

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-miss...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ThomasYoussef2003
.