phpMyFAQ CVE-2026-76206

No special conditions are required beyond network access to the phpMyFAQ PDF export endpoint. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms exploitation is possible remotely by unauthenticated attackers against default-configured installations. The attack surface is the publicly accessible PDF export route - a default feature of phpMyFAQ deployments intended to serve end users. Exploitation is bounded by the sensitivity of draft FAQ content stored in the instance: organizations whose drafts contain only benign content face lower effective risk. Impact is limited to metadata (titles, solution IDs, author names, timestamps) and does not extend to full FAQ body text, authentication credentials, or underlying system data. No non-default configuration is required to be vulnerable.

The CVSS 4.0 base score of 6.9 reflects AV:N/AC:L/AT:N/PR:N/UI:N, confirming the vulnerability is trivially reachable over the network with no preconditions, yet the confidentiality impact is bounded to VC:L with no integrity or availability consequence, capping real damage to metadata disclosure. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no referenced POC code suggest exploitation has not been observed in the wild. In practical terms, even a mid-sized municipal IT team in mielec running phpMyFAQ to manage public-service FAQs should treat this as a low-urgency but non-trivial remediation task - particularly if draft entries contain sensitive organizational content such as unreleased policy language or internal author identities. The real-world risk is primarily information leakage enabling pre-attack reconnaissance or reputational exposure from leaked draft content, not system compromise.

An unauthenticated attacker identifies a publicly accessible phpMyFAQ instance and submits HTTP GET requests to the PDF export endpoint using sequential integer FAQ identifiers. For each draft or inactive FAQ in the database, the endpoint returns metadata including the entry title, solution ID, author name, and last-update timestamp, allowing the attacker to reconstruct the unpublished content inventory without credentials or specialized tooling.