CVE-2026-76211

phpMyFAQ before 4.1.7 fails to enforce the CONFIGURATION_EDIT permission on several admin API read endpoints covering LDAP, Elasticsearch, OpenSearch, and dashboard configuration, a missing-authorization flaw (CWE-862). Any user with a valid authenticated session — not just administrators — can call these endpoints and retrieve sensitive administrative data, including LDAP server topology, bind account names, search bases, search index statistics, and site analytics. The attacker gains read-only access to low-sensitivity administrative configuration, which is why the flaw is rated medium (CVSS 4.0: 5.3, network vector, low privileges required). All deployments of phpMyFAQ running versions prior to 4.1.7 are affected, especially internet-exposed instances with ordinary non-admin user accounts. No in-the-wild exploitation is currently known; a public advisory (GHSA-7gh7-qh7c-9r8m) exists and EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade phpMyFAQ to version 4.1.7 or later, which enforces the CONFIGURATION_EDIT permission on the affected admin API endpoints. As interim mitigation, restrict access to the admin API paths at the web server or reverse proxy level and audit logs for requests to the LDAP, Elasticsearch, OpenSearch, and dashboard endpoints made by non-administrator accounts. If exposed, review the disclosed LDAP topology, bind account names, and search bases for information that could assist further attacks.