Duplicate Advisory: phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Di

Severity: low · CVSS 3.1 · Published 2026-05-15

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist). Vendors: Packagist.

Executive brief

Duplicate Advisory: phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

Affected products

Packagist phpmyfaq/phpmyfaq
Packagist thorsten/phpmyfaq

Related threats

phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement usin
phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authe
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows an
phpMyFAQ privilege escalation in GroupController::updatePermissions