An insecure direct object reference in phpMyFAQ allows a delegated administrator to request the API endpoint /admin/api/user/data/{userId} and receive full user data, including the live TOTP secret. The exposed secret permits the attacker to generate valid two‑factor authentication codes, thereby bypassing the second factor and enabling unauthorized access. This type of flaw is a classic IDOR weakness which can lead to privilege escalation.

phpMyFAQ versions 3.2.0 up to, but not including, 4.1.9, and 4.2.0‑alpha up to, but not including, 4.2.0‑beta are affected. Users running these releases should identify whether they are using an older PHP‑MyFAQ deployment that exposes the /admin/api/user/data endpoint. No other vendors or product versions are known to be impacted.

The vulnerability scores a CVSS 7, indicating a high potential impact. No EPSS score is available, but the lack of exploitation data does not reduce the likelihood that attackers could use the endpoint, because only users with administrative rights are required to access it. The flaw is listed as not in CISA’s KEV catalog, yet any compromise of the TOTP secret effectively defeats all two‑factor defenses. A delegated administrator that can hit the API endpoint is the primary attack path, and no additional environmental prerequisites are mentioned beyond the existing privileges.