# CVE-2026-85588: phpMyFAQ sensitive information disclosure in user data export

Source: https://junglewise.ai/threats/cve-2026-85588-phpmyfaq-sensitive-information-disclosure-in-user-data-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85588 · Severity: info · CVSS 5.3 · Published 2026-09-04

phpMyFAQ is a frequently-asked-questions knowledge base system used by organizations to publish self-service documentation. A flaw in its GDPR data export feature exposes active two-factor authentication (2FA) seeds in plaintext ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, completely bypassing the account's second-factor authentication and gaining unauthorized access.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-85588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85588 being exploited in the wild.

**How severe is CVE-2026-85588?** Informational severity, with a CVSS score of 5.3, published 4 September 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ <4.1.8.

**Is there a fix for CVE-2026-85588?** A patch was published on 2026-08-20: Fixed in version 4.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85588 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85588?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a sensitive information disclosure (CWE-200) in the user data export API endpoint (POST /api/user/data/export). The exportUserData() function includes the TOTP shared secret from the faquserdata table directly in the export JSON without redaction or field allowlisting. An authenticated user can trigger the export to download a ZIP containing userdata.json with plaintext "secret" and "twofactor_enabled" fields. An attacker who obtains this archive—through browser caches, email, cloud backups, or file transfer—can use the seed to generate valid one-time codes. The fix (version 4.1.8+) removes the secret field from the export and implements an explicit allowlist of safe, non-credential fields. Attack requires a valid user account and network access to the API endpoint.

## Affected products

- thorsten phpMyFAQ <4.1.8

## Timeline

- 2026-08-20: disclosed: Security advisory GHSA-xhgx-2wj8-g4pj published by maintainer
- 2026-09-04: advisory: CVE-2026-85588 published on NVD
- 2026-08-20: patched: Fixed in version 4.1.8

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xhgx-2wj8-g4pj](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-xhgx-2wj8-g4pj)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-totp-secret-exposure-via-data-export](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-totp-secret-exposure-via-data-export)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)