CVE-2026-111887: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
phpMyFAQ versions before 4.1.9 are affected, as are 4.2.0-alpha versions before 4.2.0-beta. The exposed functionality is the guest comment creation endpoint.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker can submit guest comments with candidate display-name and email values and use a distinct HTTP 409 response to confirm registered identities and associate names with email addresses.
What is the likely impact of successful exploitation?
The issue discloses whether candidate display names and email addresses are registered and can link those identities together. This information can support targeted phishing; the provided data does not indicate integrity or availability impact.
How can defenders determine whether enumeration attempts may be occurring?
Review requests to the guest comment creation endpoint, particularly repeated submissions using varying user and mail values. HTTP 409 responses from that endpoint are the observable response associated with successful account confirmation.
What remediation is available?
Upgrade affected 4.1 installations to 4.1.9 or later, and affected 4.2.0-alpha installations to 4.2.0-beta or later.