CVE-2026-45007: phpMyFAQ missing permission checks in ConfigurationTabController API

Executive brief

phpMyFAQ is an open-source FAQ software. A security flaw in its administration interface allows any logged-in user, even those without administrative rights, to view sensitive system configuration details. This includes information about the server's email setup, caching systems, and internal security models, which could be used by an attacker to plan more sophisticated attacks.

Technical details

A missing authorization check in `ConfigurationTabController.php` allows authenticated users without the `CONFIGURATION_EDIT` permission to access 12 administrative API endpoints. These endpoints only verify that a user is logged in (`userIsAuthenticated()`) rather than checking for specific administrative privileges (`userHasPermission()`). An attacker can exploit this to enumerate system metadata, including the permission model, active templates, cache backends (Redis/Memcached), mail providers, and translation services. This information disclosure facilitates reconnaissance for targeted follow-up attacks. The vulnerability is addressed in version 4.1.2.

Affected products

• thorsten phpMyFAQ <= 4.1.1

Timeline

• 2026-04-28: disclosed
• 2026-05-06: advisory
• 2026-05-06: patched: Fixed in version 4.1.2

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D