Executive brief
phpMyFAQ is a popular open-source FAQ management system used to organize and publish knowledge bases. The vulnerability allows any user with a login account to access administrative API endpoints that expose site-wide search statistics and content health metrics, even if they lack admin privileges. On installations with open user registration (the default), this information becomes effectively public and could reveal business-sensitive patterns about visitor behavior and internal content structure.
Technical details
The vulnerability is a missing authorization check (CWE-862) in two admin REST API endpoints under /admin/api/dashboard/: searches() and contentHealth(). These endpoints enforce only authentication (session validation) but lack the STATISTICS_VIEWLOGS permission check that sibling endpoints correctly implement. An attacker with any valid user account (including a zero-privilege self-registered account) can issue authenticated HTTP requests to these endpoints and retrieve sensitive internal metrics without any admin role. The fix is straightforward: add the missing $this->userHasPermission(PermissionType::STATISTICS_VIEWLOGS) call to both methods. The vulnerability affects phpMyFAQ 4.2.0-alpha development line and does not exist in the 4.1 stable branch.
Affected products
- Thorsten Hahn phpMyFAQ before 4.2.0-alpha.2
Timeline
- 2026-08-20: disclosed: Security advisory published on GitHub
- 2026-09-04: advisory: CVE-2026-85589 published
- 2026: patched: Fixed in 4.2.0-alpha.2