CVE-2026-57994: phpMyFAQ Information Disclosure via Inconsistent API Filtering

Technical summary

The vulnerability is rooted in inconsistent implementation of active status and publication-date filtering across phpMyFAQ's public API endpoints. The GET /api/v3.1/faq/{categoryId}/{faqId} endpoint returns both the title and full answer text of inactive FAQ items without proper authorization checks. Similarly, GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return inactive FAQ titles and answer previews. This inconsistent filtering allows unauthenticated, remote attackers to enumerate and retrieve non-public FAQ content by directly accessing these endpoints. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Business impact

Organizations using phpMyFAQ to manage internal or confidential FAQ content risk unintended disclosure of sensitive information. This includes draft FAQs under review, work-in-progress responses, pre-publication announcements, or content intentionally restricted to authenticated users. For support teams or knowledge management platforms, this could expose customer-sensitive details, internal processes, or competitive information. The unauthorized access does not allow modification or service disruption, but the confidentiality breach may create compliance, privacy, or reputation concerns depending on the nature of the exposed content.

Affected systems

phpMyFAQ versions prior to 4.1.5 are affected. Organizations running version 4.1.4 or earlier with publicly accessible FAQ API endpoints are at risk. The vulnerability affects the API layer specifically; web UI access controls may remain intact, but the programmatic API bypass circumvents those protections.

Exploitability

This vulnerability is straightforward to exploit. No authentication is required, no user interaction is needed, and the attack can be performed over the network. An attacker with basic knowledge of HTTP requests and the phpMyFAQ API structure can craft simple GET requests to the affected endpoints and retrieve inactive FAQ content. The attack surface is wide because the API is intended for public consumption; exploitation requires only awareness of the endpoint structure and category or tag identifiers. However, the vulnerability does not grant code execution or system-level access—it is purely an information disclosure issue.

Remediation

Upgrade phpMyFAQ to version 4.1.5 or later, which implements consistent active status and publication-date filtering across all public API endpoints. Prior to patching, organizations should review API access logs to identify whether unauthorized content retrieval has occurred and consider restricting API endpoint access via network controls or API gateway policies.

Patch guidance

Verify the latest phpMyFAQ release notes and download the patched version directly from the official phpMyFAQ repository or distribution channels. Version 4.1.5 and all subsequent releases include the corrected filtering logic. Standard package managers or containerized deployments should be updated to reflect the new version. Testing in a non-production environment is recommended to confirm API compatibility with dependent applications before production rollout.

Detection guidance

Monitor web server and API logs for repeated GET requests to /api/v3.1/faq/ and /api/v4.0/faqs/tags/ endpoints, especially from external IP addresses or unusual user-agent strings. Flag requests that query non-public or draft content identifiers. Implement API rate limiting and anomaly detection on FAQ retrieval patterns. Additionally, audit the FAQ database directly to identify which items are marked as inactive (active=no or unpublished status) and cross-reference recent API access logs against those identifiers to detect historical exploitation.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.3), this vulnerability merits prompt attention because exploitation is trivial, affects the confidentiality of sensitive business or organizational content, and requires no special conditions or user interaction. Organizations that use phpMyFAQ for management of restricted or pre-publication information should prioritize patching within the next update cycle. The lack of integrity or availability impact keeps the risk score moderate, but the ease of exploitation and potential regulatory implications (e.g., unintended data exposure) justify timely remediation.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-exploitable vulnerability with low impact on confidentiality (L), no integrity impact (N), and no availability impact (N). The score appropriately captures the information disclosure nature of the flaw. An unauthenticated, remote attacker can retrieve non-public content without special privileges or user interaction. However, the scope is unchanged (S:U) because the attacker gains access only to the FAQ content they should not see, not to other systems or resources. The moderate score should not be interpreted as low priority; the practical ease of exploitation and the sensitivity of FAQ content in many organizations warrant expedited patching.

Frequently asked questions