EUVD-2026-30592
GHSA-9r8r-x3vg-6xh4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoints by only checking login status instead of verifying backend privileges. Attackers with valid frontend user accounts can access sensitive backend operational information including dashboard versions, LDAP configuration, Elasticsearch statistics, and health-check data.
AnalysisAI
Authorization bypass in phpMyFAQ versions before 4.1.2 allows authenticated frontend users to access admin-only API endpoints and retrieve sensitive backend configuration data. The vulnerability stems from admin-api routes checking only login status (isLoggedIn) without verifying administrative privileges, enabling any valid user account to query dashboard versions, LDAP configuration details, Elasticsearch statistics, and health-check data. While this is an information disclosure issue rather than direct write access, it exposes internal infrastructure details useful for reconnaissance. The low CVSS score (4.3) reflects limited confidentiality impact, but defenders should prioritize remediation in environments where backend configuration exposure aids broader attack campaigns. Vendor patch available in version 4.1.2.
Technical ContextAI
phpMyFAQ is an open-source FAQ management system written in PHP. The vulnerability affects the authorization architecture in the Administration\Api controller namespace. The codebase implements two distinct access control methods in controller base classes: userIsAuthenticated() verifies only login status, while userHasPermission() performs role-based privilege checking. Multiple admin-api controllers (DashboardController, LdapController, ElasticsearchController, OpenSearchController, UpdateController) incorrectly use the weaker userIsAuthenticated() check despite serving administrative functions. This maps to CWE-863 (Incorrect Authorization), where authentication is present but insufficient for the sensitivity level of the resource. The affected endpoints use Symfony-style routing attributes with paths like '/admin/api/index.php/dashboard/versions', clearly indicating administrative intent. The CPE string cpe:2.3:a:thorsten:phpmyfaq identifies Thorsten Rinne as the vendor namespace. Both composer packages (thorsten/phpmyfaq and phpmyfaq/phpmyfaq) prior to 4.1.2 contain the flaw, with version 4.1.1 explicitly confirmed vulnerable.
RemediationAI
Upgrade immediately to phpMyFAQ version 4.1.2, which implements proper authorization checks in admin-api controllers by replacing userIsAuthenticated() calls with appropriate userHasPermission() role verification. Update via composer with 'composer update thorsten/phpmyfaq' or 'composer update phpmyfaq/phpmyfaq' depending on package namespace in use. Verify the patch by testing that regular user accounts can no longer access /admin/api/index.php/dashboard/versions or other admin endpoints (should return 401/403). If immediate patching is not feasible, implement compensating controls: (1) Apply web application firewall rules to block /admin/api/ paths for non-administrative source IPs, noting this breaks legitimate admin remote access and requires IP allowlisting; (2) Disable user registration if the FAQ system does not require public accounts, reducing attacker account acquisition; (3) Segment phpMyFAQ network access so that even with exposed LDAP/Elasticsearch configuration, attackers cannot reach those backend systems from the web tier. Monitor authentication logs for unusual patterns of admin-api endpoint access by non-privileged accounts. Full advisory and patch details: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today