Live › vulnerability › CVE-2026-111904
Go to dashboardphpMyFAQ 4.2.0-alpha before 4.2.0-beta has an inverted check in its open-questions controller, so the public API returns non-public moderation questions. An unauthenticated attacker can send GET requests to /api/v4.0/open-questions and read those questions along with the usernames attached to them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 4.2.0-alpha before 4.2.0-beta that expose the API to the internet are exposed, because the open-questions endpoint answers anonymous requests. Installations on an older release line or with the API closed to outside users are not described as affected by the sources.
No product ranges from the sources yet.
4.2.0-alpha up to but not including 4.2.0-beta./api/v4.0/open-questions from outside the network without logging in and see whether non-public questions appear in the response.4.2.0-beta or later./api/v4.0/open-questions at the web server or proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.
This page as .md · .json · in your agent: get_signal("CVE-2026-111904")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.