phpMyFAQ versions up to 4.2.0‑alpha misuse the isFaqAccessibleForUser routine by treating a missing FAQ translation as publicly visible. The flaw allows an attacker to supply a mismatched Accept‑Language header to the comments and attachments API endpoints, causing the system to reveal comments and attachment listings that belong to unpublished or access‑controlled FAQs. The result is unauthorized disclosure of potentially sensitive discussion and attachment data.

The vulnerability affects the phpMyFAQ web application from the vendor thorsten, specifically releases 4.2.0‑alpha through just before 4.2.0‑beta. Any environment running one of those versions without a later patch is susceptible. The flaw is tied to the Authorization Bypass bug identified as CWE‑639.

The CVSS score of 6.9 indicates a moderate risk level, while the EPSS is not available and the vulnerability is not listed in CISA KEV. Attackers can exploit it by sending a crafted HTTP request with an altered Accept‑Language header to the public API, so the attack does not require authentication. Given the moderate severity and lack of mitigation from other controls, the vulnerability warrants prompt attention.