CVE-2026-76215

phpMyFAQ versions prior to 4.1.7 fail to apply the visibility rules of a parent FAQ record when serving its child resources, a missing-authorization flaw (CWE-862) affecting the comments and attachments API endpoints. By querying those endpoints, an unauthenticated attacker can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot otherwise access. Impact is limited to disclosure of this content and metadata; there is no data modification, privilege escalation, or code execution. Any installation running an affected version and using visibility-restricted FAQs (e.g., FAQs limited to logged-in or specific user groups) is exposed. Exploitation has not been reported in the wild; the issue is documented in a public vendor advisory (GHSA-jmv9-23mw-mxpq), carries a 0.4% EPSS probability, and is fixed in phpMyFAQ 4.1.7.

What to do: Upgrade to phpMyFAQ 4.1.7 or later, which restores the parent FAQ visibility checks for comments and attachments. As an interim measure, restrict unauthenticated access to the comments and attachments API endpoints at the web server, reverse proxy, or WAF, and review access logs for queries against restricted FAQ IDs to determine whether comment text, commenter emails, or attachment filenames were exposed. No in-the-wild exploitation is currently known, so patching at the next maintenance window is a reasonable priority.