EUVD-2026-30602
GHSA-cqrw-j4qc-7f9w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, no privileges, no user interaction; only confidential data is disclosed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.
AnalysisAI
Unauthenticated information disclosure in phpMyFAQ before 4.1.2 lets attackers enumerate all FAQ entries, including restricted ones. By iterating solution IDs via the /solution_id_{id}.html endpoint, the application leaks the existence, internal ID, language, category, and title of every FAQ through HTTP 301 redirect headers and page canonical links. No user interaction is required, and a public proof-of-concept exists, though the CVE is not yet listed in CISA's Known Exploited Vulnerabilities catalog.
Technical ContextAI
The vulnerability resides in getIdFromSolutionId() in Faq.php, which constructs a SQL query joining faqdata and faqcategoryrelations solely on solution_id without applying any permission or group/user filters (CWE-863: Incorrect Authorization). The affected product is phpMyFAQ (CPE: cpe:2.3:a:thorsten:phpmyfaq:*:*:*:*:*:*:*:*), an open-source PHP FAQ application. The /solution_id_{id}.html route (FaqController::solution()) takes a sequential integer, calls the unfiltered method, and if the ID exists, builds a slugified URL and issues a 301 redirect embedding the sensitive metadata in the Location header and on the target page. This design bypasses all intended access controls on FAQ visibility.
RemediationAI
Upgrade to phpMyFAQ 4.1.2 or later, where the getIdFromSolutionId() method has been secured with proper permission checks. No viable long-term workaround exists besides upgrading. As an immediate, temporary measure, access to the /solution_id_{id}.html endpoint can be blocked via web server rules (e.g., Apache mod_rewrite or nginx location block), but this will also break public access to FAQ solutions and should not replace patching. Refer to the vendor advisory GHSA-99qv-g4x9-mgc3 for exact remediation steps.
Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. Rated critical severity (CVSS 9.8
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php. Rated high severity (CVS
In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) for modifying a glossary. Rated high severity (CVSS
In phpMyFAQ before 2.9.9, there is Cross-Site Request Forgery (CSRF) in admin/stat.main.php. Rated high severity (CVSS 8
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Rated high severi
Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated high severity (CVSS 8.8), th
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today