phpMyFAQ versions prior to 4.1.2 contain a flaw in the AbstractAdministrationController::userHasPermission() method that sends a forbidden response but does not terminate execution. Because the function continues to run, authenticated users who target admin URLs can reach the underlying page logic and retrieve administrative resources. The compromised pages expose application logs, user information, system details, and configuration data, potentially enabling further compromise of the application or host.

The vulnerability affects the phpMyFAQ project from Thorsten, impacting all releases before 4.1.2. Users running these older versions should identify the exact build and verify that it is susceptible to the bypass.

The CVSS score of 6.5 indicates a moderate to high risk. The EPSS score is unknown, so the current likelihood of widespread exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV. Attack execution requires a valid authenticated session; once logged in, an attacker may simply request any protected admin URL to obtain privileged data. The absence of a termination path makes the flaw easier to surmount, but no publicly available exploit code is noted in the advisory.