CVE-2026-76215
Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- phpmyfaq/phpmyfaq
- Source
- disclosure@vulncheck.com
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpqExploit, Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resourcesThird Party Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpqExploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.