Incorrect authorization in phpMyFAQ - CVE-2026-57994
Published: July 14, 2026
Vulnerability identifier: #VU137460
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-57994
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Thorsten Rinne
Affected software:
phpMyFAQ
phpMyFAQ
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to incorrect authorization in public FAQ API endpoints when handling requests for inactive FAQ entries. A remote attacker can send crafted API requests to disclose sensitive information.
Public routes can return inactive FAQ titles, previews, and in some cases full answer content that is intended to remain non-public.
How to mitigate CVE-2026-57994
Install security update from vendor's website.