CVE-2026-111904: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
phpMyFAQ versions from 4.2.0-alpha up to, but not including, 4.2.0-beta are affected. The exposed endpoint is /api/v4.0/open-questions.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker can issue GET requests to the affected API endpoint; no privileges or user interaction are required.
What information can be disclosed?
Attackers can retrieve hidden, non-public open questions, including moderation or internal questions, along with their associated usernames.
How can I determine whether the issue is being exploited?
Review access logs for GET requests to /api/v4.0/open-questions, especially requests from unauthenticated clients. Successful responses may indicate that hidden open-question data was exposed.
What can be done if an upgrade is not immediately possible?
Restrict or block unauthenticated access to /api/v4.0/open-questions until the affected installation can be updated to 4.2.0-beta or later.