CVE-2026-108851: phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running phpMyFAQ through 4.1.10 are exposed if MCP clients can connect to the phpmyfaq:mcp:server and use the faq_search tool. The affected data is active FAQ content restricted to particular users or groups.
What does an attacker need to exploit it?
The attacker needs access as an MCP client connected to the phpmyfaq:mcp:server. They can then submit search queries through faq_search; no additional user or group permission check is applied by the vulnerable search path.
What information can be disclosed?
An attacker can retrieve the full question and answer text of active FAQs that are intended to be restricted to specific users or groups. The provided information does not indicate modification or deletion of FAQ content.
How can I tell whether my deployment is affected?
Check whether the deployment is phpMyFAQ 4.1.10 or earlier and whether its MCP server is available to clients using the faq_search tool. Affected behavior is indicated if an MCP client can search for and receive content from an active FAQ restricted to a user or group it is not authorized to access.