Executive brief
phpMyFAQ is a popular open-source FAQ management system used by organizations to publish knowledge bases. The system allows administrators to mark FAQs as inactive (draft or under review) to keep them hidden from the public website. Due to inconsistent API validation logic, inactive FAQs can still be retrieved through certain public API routes without authentication, potentially exposing confidential or draft content that should remain private. This allows attackers to discover non-public information such as unreleased documentation, internal notes, or work-in-progress content.
Technical details
The vulnerability is a logic flaw in API endpoint filtering. The `FaqController::getByCategoryId()` method correctly applies visibility filters including `active = 'yes'` and publication date checks via `Faq::getAllAvailableFaqsByCategoryId()`. However, `FaqController::getById()` and `FaqController::getByTagId()` call alternative data retrieval methods (`Faq::getFaqByIdAndCategoryId()` and `Faq::getFaqsByIds()`) that lack these same visibility filters, returning inactive FAQ titles, previews, and full answers over HTTP 200. The attack vector is purely network-based—an unauthenticated attacker only needs to craft HTTP GET requests to `/api/v3.1/faq/{categoryId}/{faqId}` or `/api/v3.1/faqs/tags/{tagId}` to enumerate and retrieve inactive content. A working proof-of-concept is provided that reproduces the issue on phpMyFAQ 4.1.4. The defect is patched in version 4.1.5 by applying consistent active/date filtering across all public FAQ retrieval methods.
Affected products
- phpMyFAQ phpMyFAQ 4.1.0 to 4.1.4; also affects current 4.2-style branch for certain tag endpoints
Timeline
- 2026-06-14: disclosed
- 2026-08-25: advisory: GHSA-mf8r-wm2w-f8c5 published
- 2026-06-14: patched: Version 4.1.5 released with fix