What’s Vulnerable › Vulnerabilities

CVE-2026-76215: phpMyFAQ before 4.1.7 Missing Authorization via child resources

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-19 · updated 2026-09-01
• Weakness: CWE-862

Description

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

Affected products

• thorsten phpMyFAQ: before 4.1.7 — fixed in 4.1.7

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.7. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq
• https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resources
• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq

Get alerted when CVE-2026-76215 or the next vulnerability affects your stack