phpMyFAQ CVE-2026-76215

Exploitation requires that the target phpMyFAQ instance has at least one FAQ record configured with restricted visibility that also has one or more associated comments or attachments. The attacker must have network-level access to the phpMyFAQ API endpoints - no authentication, no session token, and no special account privileges are required (CVSS PR:N, UI:N). Exploitation is limited to read-only information disclosure; the attacker cannot modify or delete records through this flaw. Instances with no restricted FAQ records, or restricted FAQs with no comments or attachments, are not meaningfully affected. The flaw is not exploitable against FAQ records that are publicly visible, since those records carry no access restriction to bypass.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately captures the risk profile: fully unauthenticated, network-reachable, low-complexity exploitation with a limited confidentiality impact and no integrity or availability impact. There is no KEV listing and no reported public exploit code, which aligns with the bounded disclosure scope - this is an information-disclosure flaw, not a code-execution vector. The realistic risk is exposure of data that administrators intentionally restricted: commenter email addresses are the most sensitive element and may carry GDPR or privacy compliance implications. Operational risk scales with how sensitive the FAQ content and associated PII are in a given deployment. EPSS data was not provided in the source intelligence; given the bounded impact and niche product footprint, actual exploitation probability is likely low to moderate. This is a genuine medium-priority finding: straightforward to exploit remotely without credentials, but the blast radius is limited to metadata from already-created FAQ records.

An unauthenticated attacker discovers a phpMyFAQ instance and iterates numeric IDs against the /api/v2.0/comments and /api/v2.0/attachments endpoints. Even though the parent FAQ records carrying those IDs are configured as restricted and return an access-denied response when accessed directly, the child-resource endpoints return full payloads including comment text, commenter email addresses, and attachment filenames. The attacker enumerates these IDs sequentially or in bulk to harvest PII and potentially sensitive internal FAQ content metadata.