Executive brief
phpMyFAQ, an open-source FAQ management system, contains a security flaw where its public programming interface (API) fails to properly hide private content. This allows anyone on the internet to view FAQ entries that are still in draft mode, under review, or scheduled for future publication. As a result, sensitive internal information or unreleased documentation could be exposed to the public without authorization.
Technical details
An information disclosure vulnerability exists in phpMyFAQ versions 4.1.0 through 4.1.4 due to inconsistent authorization checks in the public API. While some endpoints correctly filter for 'active' status and publication dates, others—specifically the direct FAQ lookup and tag-based search—fail to apply these filters. An unauthenticated attacker can exploit this by querying the v3.1 or v4.0 API endpoints to retrieve the titles, previews, and full answers of FAQ entries marked as inactive or restricted by date. The root cause is located in the FaqController and Faq class methods (such as getFaqsByIds and getFaqByIdAndCategoryId) which lack the necessary SQL filtering for the 'active' flag. The issue is resolved in version 4.1.5.
Affected products
- phpMyFAQ phpMyFAQ >= 4.1.0, < 4.1.5
Timeline
- 2026-06-14: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date