CVE-2026-46362: phpMyFAQ authorization bypass in AbstractAdministrationController

Executive brief

phpMyFAQ, an open-source FAQ software, contains a flaw in its administrative permission system. An authenticated user with limited access can bypass security checks to view sensitive administrative pages, including user management, system configurations, and server logs. This could lead to the exposure of private user data, server paths, and database details, potentially allowing a low-privileged user to gain full control over the application.

Technical details

An authorization bypass exists in phpMyFAQ's AbstractAdministrationController::userHasPermission() method. When a user lacks required permissions, the method catches a ForbiddenException and sends a 'forbidden' response but fails to terminate execution (e.g., via exit() or return). Consequently, the calling controller continues to execute, fetches sensitive data, and appends the protected content to the HTTP response body after the initial forbidden message. This affects 58 admin controllers, allowing any authenticated user with basic admin login access to view logs, user data, system information, and configuration settings. The vulnerability is patched in version 4.1.2.

Affected products

• thorsten phpMyFAQ <= 4.1.1

Timeline

• 2026-05-06: advisory: GHSA-hpgw-ww76-c68r published
• 2026-05-06: patched: Fix released in version 4.1.2

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D