Description

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T14:17:46.653Z",
  "pubdate": "2026-08-19T14:17:46.653Z",
  "executiveSummary": "phpMyFAQ before 4.1.7 suffers from an access control enforcement vulnerability affecting specific administrative API read endpoints. The security flaw specifically targets endpoints responsible for retrieving configurations related to LDAP, Elasticsearch, OpenSearch, and the administrative dashboard. Due to this missing authorization check, any successfully authenticated user—regardless of their assigned administrative privileges—can bypass the intended CONFIGURATION_EDIT permission restrictions and query sensitive administrative data. The exploitation of this vulnerability leads to the unauthorized exposure of critical architectural and operational infrastructure details, including directory service topologies, bind account identifiers, search indices, and site analytics. The risk implication involves the potential disclosure of internal network topologies and credentials metadata, which significantly aids subsequent reconnaissance and targeted attack phases. Attackers require a valid user session to execute these calls against the exposed administrative API endpoints, effectively lowering the barrier for privilege escalation and internal information disclosure.",
  "technicalDetails": "The vulnerability resides within the authorization enforcement mechanism of the phpMyFAQ administrative API routing and endpoint handlers prior to version 4.1.7. Specifically, the application fails to validate whether the calling user possesses the required CONFIGURATION_EDIT administrative permission when handling read-oriented requests directed toward configuration endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard settings. The root cause is a failure in access control logic, where sensitive read operations on administrative controllers do not adequately enforce role-based access control (RBAC) checks, erroneously assuming that API route access is inherently restricted to privileged administrators.\nThe attack flow begins when an adversary or low-privileged user establishes a valid authenticated session within the phpMyFAQ application. Armed with this valid session cookie or token, the attacker crafts and sends targeted HTTP requests to the exposed administrative API read endpoints. Because the backend controller logic omits the necessary permission verification checks for these specific configuration data retrieval functions, the application processes the request and returns the requested internal parameters in the HTTP response body.\nThe affected components comprise the administrative API modules handling LDAP integration settings, Elasticsearch and OpenSearch connectivity parameters, and dashboard configuration metrics. Network exposure is constrained to environments running vulnerable instances of phpMyFAQ where the API routes are accessible to authenticated users. The payload behavior involves standard HTTP GET or equivalent API retrieval requests targeting the improperly secured endpoints. Upon successful processing, the returned data payloads contain highly sensitive reconnaissance information, including LDAP server hostnames, directory trees, bind account names, search base DNs, cluster index statistics, and internal site analytics. This post-exploitation intelligence gathering facilitates deeper reconnaissance, enabling adversaries to map out backend enterprise dependencies and plan further exploitation vectors against integrated auxiliary services."
}