All vulnerabilities
CVE-2026-111904GHSA-6xm9-p734-8fx6

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API

thorsten phpMyFAQ
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.0-betaFixed versionCVE List
Published17 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.

Text from CVE List

Affected versions 2

  • phpMyFAQaffected: 4.2.0-alpha before 4.2.0-betaCVE List
  • phpMyFAQunaffected: 4.2.0-betaCVE List

References 2