CVE-2026-76211: phpMyFAQ before 4.1.7 Information Disclosure via Admin API
phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated phpMyFAQ user can exploit it; administrative privileges are not required. The attacker needs a valid session and network access to the affected admin API endpoints.
What information may be exposed?
Affected endpoints can disclose LDAP server topology, bind account names, search bases, Elasticsearch or OpenSearch index statistics, and dashboard or site analytics configuration data.
Are all phpMyFAQ deployments affected?
The issue affects phpMyFAQ versions before 4.1.7, but exposure depends on whether the LDAP, Elasticsearch, OpenSearch, or dashboard configuration read endpoints are available and contain configured data.
What can be done if updating is not immediately possible?
Restrict access to the affected admin API endpoints to trusted administrative users and networks, and remove or disable unneeded authenticated accounts. Review access controls because the CONFIGURATION_EDIT permission is not properly enforced on the affected read endpoints.