phpMyFAQ before version 4.1.7 does not enforce parent FAQ visibility checks before serving child resources such as comments and attachments. Consequently, unauthenticated users can call the comments and attachments API endpoints and obtain restricted comment text, commenter e‑mail addresses, and attachment filenames for FAQ records that they should not be able to view. This flaw represents a missing authorization mechanism (CWE‑862) and results in a confidentiality compromise of user data and potentially sensitive file names.

All installations of phpMyFAQ prior to version 4.1.7 are affected. The vulnerability is present in the thorsten's phpMyFAQ package, so any deployment that uses an older release will be susceptible unless the application is upgraded.

The CVSS score of 6.9 indicates a medium severity issue. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is sending unauthenticated HTTP requests to the publicly exposed comments and attachments API endpoints. No authentication is required to trigger the flaw, and there are no known active exploits or zero‑day reports as of this analysis, but the ease of manipulation and the lack of access controls make the risk moderate and warranting timely remediation.