CVE-2026-76215: phpMyFAQ before 4.1.7 Missing Authorization via child resources
phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can query the comments and attachments API endpoints. No credentials or user interaction are required.
What information can be exposed?
Attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames associated with FAQ records they cannot directly access. The issue does not state that attachment contents themselves are exposed.
Are installations affected by default?
The provided information does not identify a configuration prerequisite. Exposure applies where restricted FAQ records have comments or attachments available through the affected API endpoints.
How can I determine whether my instance is affected?
Instances running phpMyFAQ before 4.1.7 are affected. Test whether an unauthenticated request to the comments or attachments API for a restricted FAQ record returns child-resource metadata or comment content.