CVE-2026-76206: phpMyFAQ before 4.1.7 Information Disclosure via PDF Export
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-update timestamps of inactive or unpublished FAQs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
phpMyFAQ deployments running a version before 4.1.7 are exposed if the public PDF export route is reachable. No authentication is required to retrieve metadata for inactive or unpublished FAQs.
What does an attacker need to exploit it?
An attacker only needs network access to the PDF export endpoint and sequential FAQ identifiers. The vector is network-accessible, requires low complexity, and does not require privileges or user interaction.
What information can be disclosed?
The endpoint can disclose draft FAQ metadata, including titles, solution IDs, author names, and last-update timestamps. The available data does not indicate disclosure of the full draft FAQ content.
How can I determine whether my instance is affected?
Instances running phpMyFAQ before 4.1.7 are affected according to the advisory. A practical check is whether unauthenticated requests to the public PDF export route for inactive or unpublished FAQ identifiers return their metadata.