Live › vulnerability › CVE-2026-111887
Go to dashboardphpMyFAQ before 4.1.9 and 4.2.0-beta returns a distinct HTTP 409 response when a guest comment uses an existing user name or email. An unauthenticated attacker can use this to confirm registered accounts and pair names with emails for targeted phishing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any phpMyFAQ instance below the fixed versions that accepts guest comments on the public comment create endpoint is exposed, since the endpoint is reachable without an account. Instances that have disabled guest comments or sit behind authentication for that endpoint are less exposed. Teams running only a patched release can skip it.
No product ranges from the sources yet.
VERSION file in the install directory, and compare it with 4.1.9 and 4.2.0-beta4.1.9 or later on the 4.1 line, or to 4.2.0-beta or later on the 4.2 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
This page as .md · .json · in your agent: get_signal("CVE-2026-111887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.