The vulnerability is a missing authorization check in the MCP server FAQ search tool of phpMyFAQ up to version 4.1.10. Because Search::searchDatabase() does not enforce user or group permissions, any MCP client that can connect to the phpmyfaq:mcp:server is able to retrieve the full question and answer text of active FAQs that are intended to be hidden from certain users or groups. This exposure represents a confidentiality breach and is classified as CWE‑862.

Affected systems are installations of Thorsten’s phpMyFAQ software version 4.1.10 or earlier that have the MCP server with the faq_search tool enabled. The flaw resides in the PHP files Search.php and the MCP server executor FaqSearchToolExecutor, and it impacts environments that allow external MCP clients to connect to the service.

The CVSS score of 4.8 reflects moderate risk. EPSS is not available, so the likelihood of exploitation is unknown; the vulnerability is not listed in the CISA KEV catalog. Attackers must first establish network connectivity to the phpmyfaq:mcp:server interface. Once connected, any MCP client can craft search queries that return the complete text of restricted FAQs, even when those were intended to be inaccessible. No publicly available exploit is documented, but the absence of authorization checks means the tool can be abused directly by any client that has network access to the service.