The vulnerability is a missing authorization check on two admin dashboard API endpoints, namely searches and content-health, which enforce authentication but no permission checks. This allows any authenticated user to read site‑wide search statistics and content‑health counters that should be restricted to privileged administrators. The weakness is classified as CWE‑862 and results in unintended information disclosure.

All installations of phpMyFAQ before version 4.2.0‑alpha.2 are affected. The product is developed by Thorsten and is identified by the generic CPE cpe:2.3:a:phpmyfaq:phpmyfaq. No specific operating system or environment constraints are mentioned.

The CVSS score of 5.3 indicates a moderate severity, and the lack of a required privilege escalation barrier makes the flaw trivial to exploit once a user is authenticated. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need only to authenticate, which can be inferred as a typical user login. Because any authenticated user can abuse the endpoints, the risk is significant for systems with broad user bases.