2026-10-11

CVE-2026-108851 Oct 11, 13:26 MEDIUM This Month

Missing authorization in the phpMyFAQ MCP server's faq_search tool allows an authenticated MCP client to read the full question-and-answer text of active FAQs that are restricted to specific users or groups, because the underlying Search::searchDatabase() routine never applies the per-user or per-group permission checks that normally govern FAQ visibility. The flaw affects phpMyFAQ through 4.1.10 and is limited to confidentiality: exploitation requires that the optional MCP server feature is deployed and reachable and that the attacker can connect to phpmyfaq:mcp:server with at least low-privilege access (CVSS PR:L, local attack vector), so this is a modest-priority issue rather than a high-urgency flaw. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis; the issue is tracked under CWE-862 (Missing Authorization).