CVE-2026-76215

6.9 mediumEPSS 0.4%

Medium (6.9) in phpmyfaq phpmyfaq. EPSS 0.4% chance of exploitation in the next 30 days.

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-08-19
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

Affected

phpmyfaq:phpmyfaq

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq
https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resources
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq

Check your stack JSON