phpMyFAQ EUVD-2026-103315

Exploitation requires an authenticated phpMyFAQ backend account that holds delegated user-management rights (PR:H) - anonymous or unauthenticated access is not sufficient, and this is the primary limiting factor. The specific trigger is calling the admin API endpoint GET /admin/api/user/data/{userId} with an arbitrary target userId; the endpoint performs no SuperAdmin or protected-target authorization check, so any such delegated admin can read any user's full faquserdata row (including the live TOTP secret). No special non-default configuration is needed beyond the existence of at least one additional privileged administrator whose data is worth stealing; affected versions are 3.2.0 before 4.1.9 and the 4.2.0 pre-release line before 4.2.0-beta.

This is a genuine but privilege-gated risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 7.0 HIGH) confirms the attack is network-reachable with low complexity and no user interaction, but PR:H means an attacker must already hold a privileged (delegated administrator with user-management rights) backend account - this is the single most important limiting factor. No EPSS score, CISA KEV listing, or POC indicator was supplied in the input, so there is no signal of active or widespread exploitation (no public exploit identified at time of analysis). The practical danger is the vulnerability's effect: an IDOR (CWE-639) that leaks a SuperAdmin's live TOTP secret, enabling a lower-privileged admin to escalate by bypassing two-factor authentication - the real-world impact (privilege escalation / 2FA bypass) is more severe than the modest 7.0 base score suggests, because it defeats a key compensating control. Note a mild internal tension: the supplied 4.0 vector assigns VI:L/VA:L, yet the described endpoint only returns data (a read-only information disclosure), so the direct integrity/availability impact is arguably none and the primary impact is confidentiality - verify with vendor/NVD. Priority should be MEDIUM-HIGH for any organization running multi-administrator phpMyFAQ deployments with delegated roles, and lower where only a single trusted SuperAdmin exists.

A delegated administrator who has been granted only user-management rights (not SuperAdmin) issues an authenticated GET request to /admin/api/user/data/{userId} for the SuperAdmin's user ID. The response returns the full faquserdata row including the live TOTP secret, which the attacker loads into any TOTP generator to produce valid one-time codes and log in as SuperAdmin, bypassing 2FA. No public exploit identified at time of analysis, but the attack requires only a single crafted authenticated HTTP request and no special tooling.