CVE-2026-57994: phpMyFAQ Information Disclosure Flaw

CVE-2026-57994 Overview

CVE-2026-57994 is an information disclosure vulnerability in phpMyFAQ before version 4.1.5. The application applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints. Unauthenticated attackers can retrieve inactive (draft or review-only) FAQ content that should not be publicly accessible. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote unauthenticated attackers can read draft and review-only FAQ titles and answers through public API endpoints, exposing non-public organizational content.

Affected Products

phpMyFAQ versions before 4.1.5
phpMyFAQ API endpoint /api/v3.1/faq/{categoryId}/{faqId}
phpMyFAQ API endpoints /api/v3.1/faqs/tags/{tagId} and /api/v4.0/faqs/tags/{tagId}

Discovery Timeline

2026-07-10 - CVE-2026-57994 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-57994

Vulnerability Analysis

The vulnerability stems from inconsistent authorization filtering across phpMyFAQ's public REST API surface. phpMyFAQ uses an active=yes flag and a publication-date window to determine whether an FAQ entry should be visible to unauthenticated users. Some API handlers correctly enforce this filter, while others omit it entirely.

The endpoint GET /api/v3.1/faq/{categoryId}/{faqId} returns the title and full answer body of inactive FAQs when queried by ID. The tag-based endpoints GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return inactive FAQ titles and answer previews. Attackers can enumerate identifiers to harvest draft content across the deployment.

Root Cause

The root cause is missing enforcement of the active status check and publication-date filter in the affected API controllers. Authorization logic is duplicated across multiple endpoints instead of centralized, which allowed the filter to be omitted on specific routes.

Attack Vector

Exploitation requires only network access to the phpMyFAQ instance. No authentication, user interaction, or elevated privileges are needed. An attacker sends direct HTTP GET requests to the vulnerable endpoints while iterating over categoryId, faqId, or tagId values to disclose non-public content. Refer to the GitHub Security Advisory GHSA-mf8r-wm2w-f8c5 and the VulnCheck Advisory for full technical details.

Detection Methods for CVE-2026-57994

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/v3.1/faq/{categoryId}/{faqId} with sequential or enumerated FAQ IDs.
Repeated requests to /api/v3.1/faqs/tags/{tagId} or /api/v4.0/faqs/tags/{tagId} from a single source IP.
Access log entries returning HTTP 200 for FAQ IDs that are not linked from the public FAQ index.

Detection Strategies

Monitor web server access logs for high-volume enumeration patterns against phpMyFAQ API paths under /api/v3.1/ and /api/v4.0/.
Correlate application logs with the phpMyFAQ database active column to detect responses returning inactive entries.
Deploy Web Application Firewall (WAF) rules that rate-limit or alert on ID enumeration behavior against the affected routes.

Monitoring Recommendations

Enable verbose HTTP request logging on the phpMyFAQ web server, including source IP, path, and response size.
Alert on any unauthenticated API response that references FAQ records flagged as draft or review-only.
Track the ratio of API responses to unique client IPs to identify scraping behavior.

How to Mitigate CVE-2026-57994

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.5 or later, which enforces consistent active=yes and publication-date filtering across all public API endpoints.
Audit application logs for prior unauthenticated access to the affected endpoints and identify any draft content that may have been exposed.
Rotate or unpublish any sensitive draft FAQs that were staged in the application before the patch was applied.

Patch Information

The fix is available in phpMyFAQ 4.1.5. See the GitHub Security Advisory GHSA-mf8r-wm2w-f8c5 for the upstream patch and release notes.

Workarounds

Restrict access to /api/v3.1/faq/, /api/v3.1/faqs/tags/, and /api/v4.0/faqs/tags/ at the reverse proxy or WAF until the upgrade is complete.
Avoid storing sensitive or pre-release content as inactive FAQ entries in vulnerable versions.
Require authentication in front of the phpMyFAQ API using network-layer controls where feasible.

bash

# Example nginx configuration to block affected endpoints until patched
location ~ ^/api/(v3\.1/faq/|v3\.1/faqs/tags/|v4\.0/faqs/tags/) {
    deny all;
    return 403;
}