phpMyFAQ CVE-2026-111902

Exploitation requires the target phpMyFAQ instance to be running an affected 4.2.0-alpha build (pre-4.2.0-beta) and the attacker to target a FAQ that is unpublished or ACL-restricted AND missing a translation in the language requested via a mismatched Accept-Language HTTP header sent to the comments or attachments API endpoints - the missing-translation condition is what causes isFaqAccessibleForUser() to default the item to publicly visible. No authentication, privileges, or user interaction are required (PR:N/UI:N). Limiting factors: disclosure is confined to comments and attachment listings (not full FAQ body content), the impact is read-only confidentiality, and the flaw only exists in pre-release alpha code, so patched or stable deployments are unaffected.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) scores 6.9 (MEDIUM) and describes a remote, unauthenticated, low-complexity attack requiring no user interaction - meaning the barrier to triggering it is minimal. However, the impact is deliberately narrow: confidentiality-only (VC:L, with VI:N/VA:N/SC:N), limited to reading comments and attachment listings of unpublished or ACL-restricted FAQs via the authorization bypass in isFaqAccessibleForUser() (CWE-639). There is no integrity, availability, or scope impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are not conflicting, they are simply absent, which is consistent with a recently-disclosed MEDIUM information-disclosure bug. A critical mitigating factor the raw score does not capture: the affected code exists only in the pre-release range '4.2.0-alpha before 4.2.0-beta', so production exposure is very limited. Net assessment: a genuine but low-priority information-disclosure issue, not a high-urgency threat; easy to trigger but low consequence, and scoped to pre-release software.

An unauthenticated attacker targets a phpMyFAQ 4.2.0-alpha instance and identifies a FAQ that is unpublished or ACL-restricted but lacks a translation in a particular language. They issue requests to the comments and attachments API endpoints with a mismatched Accept-Language header, causing isFaqAccessibleForUser() to treat the missing translation as public and return the restricted FAQ's comments and attachment listings. No public exploit code is identified in the provided data, though the technique requires only a crafted HTTP header.