EUVD-2026-30602
GHSA-cqrw-j4qc-7f9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend sequential HTTP GET requests to /solution_id_X.html
-
DeliverygetIdFromSolutionId() returns FAQ data without permission check
-
ExploitServer 301-redirects to /content/<category>/<id>/<lang>/<title-slug>.html
-
ExecutionAttacker extracts title, ID, language, and category from Location header or page source
-
ImpactRepeat for all IDs to disclose entire FAQ repository
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of phpMyFAQ. The /solution_id_{id}.html route is publicly accessible by design; the vulnerability exists because internal permission checks are missing. No client interaction is required, and the attack can be fully automated. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) indicates a network-accessible, low-complexity attack with no privileges or user interaction required, leading to high confidentiality impact but no integrity or availability loss. The EPSS score of 0.06% (19th percentile) suggests low likelihood of widespread exploitation, aligning with the absence of KEV listing. However, the SSVC decision framework notes that a PoC exists, the vulnerability is automatable, and technical impact is partial. In summary, this is an easily exploitable information disclosure with high immediate impact per successful attack, but its real-world exploitation probability is currently assessed as low due to limited scanning and exploitation activity. Defenders should prioritize patching for exposed instances, especially those serving sensitive internal FAQs. |
| Exploit ScenarioDerived | An unauthenticated attacker sends sequential GET requests to example.com/solution_id_1.html, solution_id_2.html, etc. For each valid ID, the server issues a 301 redirect whose Location header and the final page's canonical link reveal the FAQ title, category, and internal ID. By iterating through a range of integers, the attacker can map all FAQs regardless of their intended access restrictions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 28, 2026
Unauthenticated information disclosure in phpMyFAQ before 4.1.2 lets attackers enumerate all FAQ entries, including restricted ones. By iterating solution IDs via the /solution_id_{id}.html endpoint, the application leaks the existence, internal ID, language, category, and title of every FAQ through HTTP 301 redirect headers and page canonical links. No user interaction is required, and a public proof-of-concept exists, though the CVE is not yet listed in CISA's Known Exploited Vulnerabilities catalog.
RemediationAI
Upgrade to phpMyFAQ 4.1.2 or later, where the getIdFromSolutionId() method has been secured with proper permission checks. No viable long-term workaround exists besides upgrading. As an immediate, temporary measure, access to the /solution_id_{id}.html endpoint can be blocked via web server rules (e.g., Apache mod_rewrite or nginx location block), but this will also break public access to FAQ solutions and should not replace patching. Refer to the vendor advisory GHSA-99qv-g4x9-mgc3 for exact remediation steps.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in getIdFromSolutionId() in Faq.php, which constructs a SQL query joining faqdata and faqcategoryrelations solely on solution_id without applying any permission or group/user filters (CWE-863: Incorrect Authorization). The affected product is phpMyFAQ (CPE: cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:*), an open-source PHP FAQ application. The /solution_id_{id}.html route (FaqController::solution()) takes a sequential integer, calls the unfiltered method, and if the ID exists, builds a slugified URL and issues a 301 redirect embedding the sensitive metadata in the Location header and on the target page. This design bypasses all intended access controls on FAQ visibility.
Know when Phpmyfaq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-accessible, no privileges, no user interaction; only confidential data is disclosed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Duplicate-email registration handling in phpMyFAQ 4.0.7 through 4.0.13 (and 4.0-nightly-2025-10-03 and earlier) lets una
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Exploit-DB