Executive brief
phpMyFAQ is an open-source knowledge base system used to manage and share frequently asked questions. A security flaw allows unauthorized visitors to discover the existence and titles of private FAQ entries that should be restricted to specific users or groups. This could lead to the exposure of sensitive internal project names, confidential topics, or organizational secrets contained within the FAQ titles.
Technical details
An Improper Authorization vulnerability exists in phpMyFAQ's handling of solution ID routes. The `getIdFromSolutionId` method in `Faq.php` lacks a permission filter in its SQL query, allowing unauthenticated users to retrieve metadata for restricted FAQs. When a user accesses `/solution_id_{id}.html`, the application performs a 301 redirect to a URL containing the slugified title of the FAQ, even if the user lacks permission to view the content. Additionally, `getFaqBySolutionId` contains a fallback query intended for testing that bypasses ACLs in production. Attackers can enumerate sequential solution IDs to leak the titles and existence of all restricted FAQs. This is patched in version 4.1.2.
Affected products
- thorsten phpMyFAQ <= 4.1.1
Timeline
- 2026-04-28: disclosed
- 2026-05-06: advisory
- 2026-06-09: other: Advisory updated