Description
phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content. Specifically, GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer, while GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return the inactive FAQ title and answer preview, disclosing non-public content.
Published: 2026-07-10
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

phpMyFAQ versions before inconsistent filtering of active status and publication dates in multiple public API endpoints, allowing an unauthenticated attacker to request FAQ items that are marked as inactive or in draft. GET /api/v3.1/faq/{categoryId}/{faqId} returns the full title and answer of such items, while GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} and a preview of the answer, resulting in confidential non‑public content being exposed to anyone who can access the API.

Affected Systems

phpMyFAQ, all releases older than version 4.1.5 are affected.

Risk and Exploitability

The CVSS score of 6.9 indicates a requires no authentication and can be performed over the public API, making it trivial for any outsider to trigger. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be the public HTTP API.

Generated by OpenCVE AI on July 29, 2026 at 10:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade phpMyFAQ to version 4.1.5 or later, where the public API filtering has been corrected to prevent CWE‑200 information disclosure.
  • Limit access to public FAQ API endpoints, ensuring that only authorized clients can retrieve FAQ data and mitigating the risk of unauthorized disclosure (CWE‑200).
  • Enable logging and monitoring of API requests, alerting on repeated attempts to access inactive content, to detect potential exploitation of the information disclosure vulnerability (CWE‑200).

Generated by OpenCVE AI on July 29, 2026 at 10:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content. Specifically, GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer, while GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return the inactive FAQ title and answer preview, disclosing non-public content.
Title phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints
First Time appeared Phpmyfaq
Phpmyfaq phpmyfaq
Weaknesses CWE-200
CPEs cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*
Vendors & Products Phpmyfaq
Phpmyfaq phpmyfaq
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Phpmyfaq Phpmyfaq
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-07-10T14:55:58.886Z

Reserved: 2026-06-26T17:58:05.796Z

Link: CVE-2026-57994

cve-icon Vulnrichment

Updated: 2026-07-10T14:53:38.759Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:00:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor