The vulnerability originates from missing permission checks in twelve configuration API endpoints within phpMyFAQ. The code verifies only that a user is authenticated but does not confirm that the user has the CONFIGURATION_EDIT permission. Consequently, any authenticated user can query the /admin/api/configuration endpoints to retrieve detailed system configuration metadata, exposing the permission model, cache backend, mail provider, and translation provider. This exposure violates the principle of least privilege and enables attackers to gather sensitive configuration information.

phpMyFAQ versions prior to 4.1.2, developed by thorsten, are susceptible. Instances running any of these releases are affected.

The CVSS score of 4.3 indicates a moderate severity. Exploitation requires only legitimate login credentials, a condition fulfilled by any authenticated user. The vulnerability is not listed in the CISA KEV catalog and the EPSS score is unavailable, leaving the likelihood of exploitation uncertain but potentially high in environments with broad user access. Administrators should treat this as a moderate risk that can be mitigated by installing the patch.