The vulnerability resides in phpMyFAQ 4.0.16 and earlier, where several publicly exposed API endpoints lack proper access checks. The OpenQuestionController::list() method calls Question::getAll() with showAll=true by default, returning items marked as non-public (isVisible=false) and attaching the corresponding user email addresses. Similar weaknesses exist in comment, news, and FAQ APIs. Consequently, an unauthenticated attacker can retrieve private question data and email addresses, facilitating phishing or other social engineering attacks. The weakness aligns with CWE‑200, a data‑exposure flaw.

The affected software is Thorsten’s phpMyFAQ application. Versions 4.0.16 and earlier are vulnerable; the issue was resolved in version 4.0.17. The product is distributed under the cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* identifier.

The CVSS base score of 5.3 indicates moderate severity. With an EPSS score below 1 % the current economic exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is reachable through publicly available API URLs that do not require authentication, so an attacker could automatically harvest email addresses or private content by simply invoking those endpoints. Mitigating this risk requires applying the vendor’s patch or restricting unauthenticated API access.