# CVE-2026-46366: phpMyFAQ information disclosure in getIdFromSolutionId

Source: https://junglewise.ai/threats/cve-2026-46366-phpmyfaq-information-disclosure-in-getidfromsolutionid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-46366 · Severity: high · CVSS 7.5 · Published 2026-05-15

phpMyFAQ is an open-source knowledge base system used to manage and share frequently asked questions. A security flaw allows unauthorized visitors to discover the existence and titles of private FAQ entries that should be restricted to specific users or groups. This could lead to the exposure of sensitive internal project names, confidential topics, or organizational secrets contained within the FAQ titles.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq), [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-46366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46366 being exploited in the wild.

**How severe is CVE-2026-46366?** High severity, with a CVSS score of 7.5, published 15 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

**Is there a fix for CVE-2026-46366?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46366 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46366?** Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.2
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.2
  ```


## Technical details

An Improper Authorization vulnerability exists in phpMyFAQ's handling of solution ID routes. The `getIdFromSolutionId` method in `Faq.php` lacks a permission filter in its SQL query, allowing unauthenticated users to retrieve metadata for restricted FAQs. When a user accesses `/solution_id_{id}.html`, the application performs a 301 redirect to a URL containing the slugified title of the FAQ, even if the user lacks permission to view the content. Additionally, `getFaqBySolutionId` contains a fallback query intended for testing that bypasses ACLs in production. Attackers can enumerate sequential solution IDs to leak the titles and existence of all restricted FAQs. This is patched in version 4.1.2.

## Affected products

- thorsten phpMyFAQ <= 4.1.1

## Identifiers

- CVE-2026-46366
- GHSA-99qv-g4x9-mgc3

## Timeline

- 2026-04-28: disclosed
- 2026-05-06: advisory
- 2026-06-09: other: Advisory updated

## References

- [https://api.github.com/users/adrgs](https://api.github.com/users/adrgs)
- [https://github.com/adrgs](https://github.com/adrgs)
- [https://api.github.com/users/adrgs/gists%7B/gist_id%7D](https://api.github.com/users/adrgs/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrgs/repos](https://api.github.com/users/adrgs/repos)
- [https://avatars.githubusercontent.com/u/11564377?v=4](https://avatars.githubusercontent.com/u/11564377?v=4)
- [https://api.github.com/users/adrgs/events%7B/privacy%7D](https://api.github.com/users/adrgs/events%7B/privacy%7D)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)