Is CVE-2026-47132 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47132 being exploited in the wild.

How severe is CVE-2026-47132?

Medium severity, with a CVSS score of 5.4, published 24 September 2026.

Which products and versions are affected?

thorsten/phpmyfaq (Packagist) < 4.2.0-alpha, ECOSYSTEM:introduced=0,fixed=4.2.0-alpha.

Is there a fix for CVE-2026-47132?

Yes. thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47132 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-47132?

Check whether you run thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47132: phpMyFAQ SQL LIKE wildcard injection in chat user search

Q: Is there a fix for CVE-2026-47132?

Yes. thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47132 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-47132?

Check whether you run thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47132 · Severity: medium · CVSS 5.4 · Published 2026-09-24

phpMyFAQ, an open-source FAQ software, contains a vulnerability in its chat user search feature. An authenticated user can bypass search filters to view a list of all active users, including their IDs and display names. This could lead to the exposure of internal staff identities, department names, or other sensitive account information.

Technologies: thorsten/phpmyfaq (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-47132 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47132 being exploited in the wild.
How severe is CVE-2026-47132?: Medium severity, with a CVSS score of 5.4, published 24 September 2026.
Which products and versions are affected?: thorsten/phpmyfaq (Packagist) < 4.2.0-alpha, ECOSYSTEM:introduced=0,fixed=4.2.0-alpha.
Is there a fix for CVE-2026-47132?: Yes. thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47132 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-47132?: Check whether you run thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

thorsten/phpmyfaq (Packagist): upgrade to 4.2.0-alpha or later
```
composer require thorsten/phpmyfaq:^4.2.0-alpha
```

Technical details

The vulnerability exists in the `ChatController.php` and `Chat.php` components of phpMyFAQ. While the application uses an `escape()` method to prevent standard SQL string breakout, it fails to neutralize SQL `LIKE` metacharacters such as `%` and `_` in the `searchTerm` parameter of the `/api/chat/users` endpoint. An authenticated attacker can provide these wildcards to bypass the intended search logic and retrieve all active user records from the `faquser` and `faquserdata` tables. This issue is addressed in version 4.2.0-alpha by implementing proper wildcard escaping.

Affected products

thorsten phpMyFAQ < 4.2.0-alpha

Identifiers

CVE-2026-47132
GHSA-6pvm-2vjj-rx4w

Timeline

2026-08-08: disclosed
2026-08-08: patched: Patched in version 4.2.0-alpha via commit bd4b08b
2026-08-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.