CVE-2026-85589: phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and content-health counters regardless of their privilege level.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the affected dashboard API endpoints?
Any authenticated phpMyFAQ user can access the searches and content-health dashboard API endpoints, regardless of assigned privilege level. An attacker does not need administrative permissions, but does need a valid authenticated account.
What information could an unauthorized user obtain?
The affected endpoints expose site-wide search statistics and content-health counters. The available data indicates an information disclosure issue rather than modification of dashboard data or settings.
Are deployments running phpMyFAQ 4.2.0-alpha.2 affected?
The issue affects phpMyFAQ versions before 4.2.0-alpha.2. The provided information does not identify any other affected or fixed version boundaries.