phpMyFAQ CVE-2026-76211

Exploitation requires a valid authenticated session in phpMyFAQ - any account, including the lowest-privileged registered user, is sufficient. No special role, no CONFIGURATION_EDIT permission, and no administrative access is needed. The vulnerability manifests specifically when LDAP, Elasticsearch, or OpenSearch integrations are configured in the phpMyFAQ instance; if none of these integrations are active, the relevant endpoints return minimal or no sensitive data. Exploitation is limited to authenticated users only (PR:L per CVSS 4.0) - unauthenticated anonymous access to these endpoints is not indicated by the description or vector.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a limited-confidentiality, no-integrity, no-availability flaw. The vector confirms network reachability (AV:N), trivial exploitation mechanics (AC:L, AT:N), and a requirement for at least a low-privileged authenticated session (PR:L). Real-world risk is moderate but contextual: in deployments integrating with corporate LDAP directories, exposure of bind account names and search base paths can materially assist lateral movement or targeted directory attacks. Elasticsearch/OpenSearch index names and statistics can reveal internal data architecture. No CISA KEV listing and no confirmed public exploit code exist, and EPSS data was not provided in the input - exploitation likelihood is inferred as low to moderate based on the low-complexity, authenticated-only access requirement. The primary risk amplifier is the quality of the leaked data (LDAP topology, directory bind accounts) rather than CVSS magnitude alone.

An attacker who has obtained any valid phpMyFAQ account - through registration, credential stuffing, or social engineering - authenticates to the application and directly calls the admin API LDAP configuration read endpoint using their session token. Without triggering any permission error, the response returns the LDAP server address, bind DN, and search base configuration, which the attacker uses to map the organization's directory infrastructure for a subsequent targeted attack.