Observable Response Discrepancy in phpMyFAQ - CVE-2026-111887
Published: November 11, 2026 / Updated: November 12, 2026
Vulnerability identifier: #VU165945
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111887
CWE-ID: CWE-204
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to enumerate registered display names and email addresses.
The vulnerability exists due to an observable response discrepancy in the phpMyFAQ guest comment controller when processing submitted identities, returning HTTP 409 only when both independent account-existence checks succeed. A remote attacker can submit guest comments to /api/comment/create with candidate user and mail values, holding one known-existing value constant and varying the other, to identify registered names or email addresses from response statuses.
Affected software
phpMyFAQ
How to mitigate CVE-2026-111887
Install security update from vendor's website.
phpMyFAQ - update to 4.1.9