The vulnerability in phpMyFAQ versions 4.2.0-alpha through before 4.2.0-beta allows an attacker to read hidden open questions that should remain private. An inverted check in the OpenQuestionController causes non-public moderation or internal questions along with the usernames of the poster to be returned when a GET request is made to the /api/v4.0/open-questions endpoint. This flaw enables unauthenticated disclosure of sensitive data without requiring any additional privileges or authentication, as attackers can simply issue HTTP GET requests to the exposed API. The weakness is catalogued as CWE-200, representing an information disclosure flaw.

The affected vendor is thorsten:phpMyFAQ, specifically the phpMyFAQ product. The vulnerability exists in all releases from version 4.2.0-alpha up through, but not including, version 4.2.0-beta. No additional sub‑version information is provided; administrators should verify whether their deployment falls within this range.

The CVSS score of 6.9 indicates moderate severity and the vulnerability is publicly documented, but the EPSS score is not available, suggesting a currently unknown exploitation probability. The flaw is not listed in the CISA KEV catalog, yet its nature allows unauthenticated disclosure of potentially sensitive question content. Attackers simply need network visibility to the application and can request the API endpoint, making the workaround simple but the risk significant for any community or internal use of the system.