{"id":"CVE-2026-111887","kind":"vulnerability","aliases":["CVE-2026-111887"],"related":[],"title":"phpMyFAQ: comment endpoint leaks which display names and emails are registered","description":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.","summary":"phpMyFAQ before 4.1.9 and 4.2.0-beta returns a distinct HTTP 409 response when a guest comment uses an existing user name or email. An unauthenticated attacker can use this to confirm registered accounts and pair names with emails for targeted phishing.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["faq-sites","php","phpmyfaq","runtime","self-hosted"],"not_affected_if":["guest-comments-disabled","patched-version"],"how_to_check":"- Check the installed phpMyFAQ version in the admin panel or the `VERSION` file in the install directory, and compare it with `4.1.9` and `4.2.0-beta`\n- Submit a guest comment with a known registered name and email on a test copy and confirm whether the response is HTTP 409","fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line","status":"open","published_at":"2026-10-17T19:16:29+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:42:18+00:00","updated_at":"2026-10-25T03:42:18+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:42:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line","reach":"internet","title":"phpMyFAQ: comment endpoint leaks which display names and emails are registered","impact":"low","summary":"phpMyFAQ before 4.1.9 and 4.2.0-beta returns a distinct HTTP 409 response when a guest comment uses an existing user name or email. An unauthenticated attacker can use this to confirm registered accounts and pair names with emails for targeted phishing.","category":"runtime","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted","faq-sites"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker confirms registered user names and emails for phishing","analyst_note":"","how_to_check":"- Check the installed phpMyFAQ version in the admin panel or the `VERSION` file in the install directory, and compare it with `4.1.9` and `4.2.0-beta`\n- Submit a guest comment with a known registered name and email on a test copy and confirm whether the response is HTTP 409","needs_analyst":false,"not_affected_if":["guest-comments-disabled","patched-version"],"who_is_affected":"Any phpMyFAQ instance below the fixed versions that accepts guest comments on the public comment create endpoint is exposed, since the endpoint is reachable without an account. Instances that have disabled guest comments or sit behind authentication for that endpoint are less exposed. Teams running only a patched release can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000631,"input_tokens":3364,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111887':14A,17A '-2026':13A,16A '4.1.9':29B,70C '4.2.0':31B,72C,75C '409':37B,97C 'account':59B,79C 'allow':83C 'alpha':73C 'attack':52B,85C,99C 'beta':32B,76C 'candid':110C 'comment':2A,42B,103C,106C 'confirm':57B,87C 'contain':77C 'creat':107C 'cve':12A,15A 'display':6A,89C 'distinct':35B,95C 'email':9A,49B,64B,92C,119C 'endpoint':3A,108C 'enumer':80C 'exist':45B 'faq':19B 'faq-sit':18B 'guest':41B,102C 'host':26B 'http':36B,96C 'leak':4A 'link':116C 'mail':113C 'name':7A,47B,62B,90C,117C 'pair':61B 'phish':67B,122C 'php':21B 'phpmyfaq':1A,22B,27B,68C 'regist':11A,58B,88C 'respons':38B,98C 'return':33B 'runtim':23B 'self':25B 'self-host':24B 'site':20B 'submit':101C 'target':66B,121C 'unauthent':51B,84C 'use':43B,54B 'user':46B,111C 'valu':114C 'via':93C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Any phpMyFAQ instance below the fixed versions that accepts guest comments on the public comment create endpoint is exposed, since the endpoint is reachable without an account. Instances that have disabled guest comments or sit behind authentication for that endpoint are less exposed. Teams running only a patched release can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111887","severity":null,"published_at":"2026-10-17T19:16:29+00:00","modified_at":"2026-10-18T14:16:54+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}