Description

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T14:17:47.607Z",
  "pubdate": "2026-08-19T14:17:47.607Z",
  "executiveSummary": "phpMyFAQ before version 4.1.7 suffers from an access control enforcement vulnerability affecting child resources associated with FAQ records. Specifically, the application fails to perform necessary visibility and permission checks on parent FAQ entries prior to serving nested resources such as comments and attachments through dedicated API endpoints.\nThis authorization bypass allows unauthenticated remote attackers to retrieve sensitive data, including restricted comment text, commenters' email addresses, and attachment filenames, even when the parent FAQ records are private, restricted, or otherwise inaccessible to unauthorized users.\nThe risk implication is unauthorized information disclosure of confidential internal knowledge base assets, potentially exposing personally identifiable information (PII) of commenters and proprietary organizational data. Exploitation requires network access to the target phpMyFAQ instance and the ability to interact with the comments and attachments API endpoints. No prior authentication, special privileges, or user interaction are required to successfully harvest these unauthorized child resources.",
  "technicalDetails": "The root cause of this vulnerability lies in the missing or inadequate server-side authorization logic within the API controller handlers responsible for processing comment and attachment retrieval requests in phpMyFAQ prior to version 4.1.7.\nDuring normal operational flow, access control lists (ACLs) or visibility status evaluations are correctly enforced when a user attempts to view a parent FAQ record directly through the standard user interface or primary viewing endpoints. However, the secondary API endpoints designed to fetch associated child resources—specifically comments and attachments—fail to inherit or independently execute these parent visibility checks.\nThe attack flow proceeds as follows: an unauthenticated attacker identifies or enumerates valid FAQ record identifiers. Instead of querying the protected parent FAQ endpoint, the attacker directly transmits HTTP requests to the vulnerable comments and attachments API endpoints using the targeted FAQ identifiers. Because the application logic lacks hierarchical permission inheritance, it processes the request without validating whether the requesting entity possesses the rights to view the parent FAQ record.\nUpon receiving the request, the underlying database queries retrieve the associated child metadata and content without restriction. The application then serializes and returns this sensitive data—including comment bodies, submitter email addresses, and file naming conventions of attachments—directly in the API response payload.\nThe vulnerable components encompass the API endpoints and associated backend controllers handling comment and attachment retrieval operations within phpMyFAQ versions prior to 4.1.7. Network exposure is external, as these API endpoints are typically accessible via standard HTTP/HTTPS web interfaces without authentication gates. The post-exploitation impact is limited to read-only information disclosure, successfully breaching confidentiality boundaries by leaking restricted knowledge base content and internal metadata to unauthorized external entities."
}