# CVE-2026-57994: phpMyFAQ information disclosure of inactive FAQ content in public API

Source: https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-57994 · Severity: medium · CVSS 5.3 · Published 2026-07-10

phpMyFAQ, an open-source FAQ management system, contains a security flaw where its public programming interface (API) fails to properly hide private content. This allows anyone on the internet to view FAQ entries that are still in draft mode, under review, or scheduled for future publication. As a result, sensitive internal information or unreleased documentation could be exposed to the public without authorization.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-57994 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57994 being exploited in the wild.

**How severe is CVE-2026-57994?** Medium severity, with a CVSS score of 5.3, published 10 July 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) ECOSYSTEM:introduced=4.1.0,fixed=4.1.5; thorsten/phpmyfaq (Packagist) ECOSYSTEM:introduced=4.1.0,fixed=4.1.5.

**Is there a fix for CVE-2026-57994?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.5 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57994 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57994?** Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.5 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.5
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.5 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.5
  ```


## Technical details

An information disclosure vulnerability exists in phpMyFAQ versions 4.1.0 through 4.1.4 due to inconsistent authorization checks in the public API. While some endpoints correctly filter for 'active' status and publication dates, others—specifically the direct FAQ lookup and tag-based search—fail to apply these filters. An unauthenticated attacker can exploit this by querying the v3.1 or v4.0 API endpoints to retrieve the titles, previews, and full answers of FAQ entries marked as inactive or restricted by date. The root cause is located in the FaqController and Faq class methods (such as getFaqsByIds and getFaqByIdAndCategoryId) which lack the necessary SQL filtering for the 'active' flag. The issue is resolved in version 4.1.5.

## Affected products

- phpMyFAQ phpMyFAQ >= 4.1.0, < 4.1.5

## Identifiers

- CVE-2026-57994
- GHSA-mf8r-wm2w-f8c5

## Timeline

- 2026-06-14: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mf8r-wm2w-f8c5](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mf8r-wm2w-f8c5)
- [https://www.vulncheck.com/advisories/phpmyfaq-information-disclosure-of-inactive-faq-content-via-public-api-endpoints](https://www.vulncheck.com/advisories/phpmyfaq-information-disclosure-of-inactive-faq-content-via-public-api-endpoints)

## Related threats

- [phpMyFAQ SQL injection in StopWords::add()](https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add)
- [phpMyFAQ SQL LIKE wildcard injection in chat user search](https://junglewise.ai/threats/cve-2026-47132-phpmyfaq-sql-like-wildcard-injection-in-chat-user-search)
- [phpMyFAQ two-factor authentication password bypass](https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass)
- [phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass)
- [phpMyFAQ path traversal in PDF export concatenatePaths function](https://junglewise.ai/threats/cve-2026-57961-phpmyfaq-path-traversal-in-pdf-export-concatenatepaths-function)