CVE-2026-76206: phpMyFAQ Information Disclosure Flaw

CVE-2026-76206 Overview

CVE-2026-76206 is an information disclosure vulnerability in phpMyFAQ versions before 4.1.7. The PDF export endpoint fails to validate the active status of FAQ entries before returning data. Unauthenticated attackers can query the public PDF export route with sequential FAQ identifiers to retrieve metadata from inactive or unpublished FAQs. Exposed metadata includes titles, solution IDs, author names, and last-update timestamps. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate draft and inactive FAQ metadata, including titles, author names, and internal solution identifiers, without triggering authentication controls.

Affected Products

phpMyFAQ versions prior to 4.1.7
phpMyFAQ PDF export endpoint
Self-hosted phpMyFAQ deployments exposing the public export route

Discovery Timeline

2026-08-19 - CVE-2026-76206 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76206

Vulnerability Analysis

The vulnerability resides in the phpMyFAQ PDF export handler. The endpoint accepts a FAQ identifier and generates a PDF representation of the corresponding entry. The handler queries the underlying FAQ records but omits a check on the active flag that governs whether an entry is published. As a result, draft, archived, and administratively disabled FAQs remain reachable through the export path.

Attackers iterate sequential integer identifiers against the export route. Each request returns metadata fields embedded in the generated PDF or the response payload. The exposed fields include the FAQ title, the solution identifier, the author name, and the last-modified timestamp. This telemetry supports reconnaissance against internal knowledge base content, disclosure of staff usernames, and identification of unpublished support material.

The issue is scoped to information disclosure. It does not permit modification of records or execution of code on the host. Fixed builds in phpMyFAQ 4.1.7 add the missing active-status check to the export handler.

Root Cause

The root cause is missing authorization logic on the PDF export endpoint. The handler enforces neither authentication nor a state check against the FAQ active column. This is a broken access control pattern where a public route exposes records that should be gated by publication state.

Attack Vector

The attack requires only network access to the phpMyFAQ instance. No credentials, user interaction, or elevated privileges are needed. An attacker sends HTTP GET requests to the public PDF export route with incrementing FAQ IDs. The server returns PDF documents containing metadata from every existing record, regardless of publication state. Automated enumeration scripts can harvest the entire draft FAQ inventory within minutes.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-f8pr-32pp-mp7h and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-76206

Indicators of Compromise

Sequential HTTP GET requests to the phpMyFAQ PDF export route from a single client IP within a short time window.
Elevated request volume against the PDF export endpoint with incrementing numeric FAQ identifiers.
Access log entries showing PDF export requests from unauthenticated sessions or missing session cookies.
User-Agent strings consistent with scripted clients such as curl, python-requests, or wget hitting the export path.

Detection Strategies

Deploy web server access log rules that flag rapid enumeration of the PDF export endpoint by identifier.
Correlate response sizes on the export route to identify successful retrievals against IDs outside the published range.
Alert on unauthenticated clients accessing PDF exports of FAQs that carry an inactive status in the database.

Monitoring Recommendations

Ingest phpMyFAQ web server logs into a centralized log platform and retain them for at least 90 days.
Baseline normal PDF export request rates and alert on deviations above baseline thresholds.
Review authentication-free access to any endpoint that renders database-backed content.

How to Mitigate CVE-2026-76206

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.7 or later on all production and staging deployments.
Audit web server access logs for prior enumeration attempts against the PDF export endpoint.
Restrict public access to the PDF export route via reverse proxy or web server rules until patching is complete.

Patch Information

phpMyFAQ 4.1.7 introduces the missing active-status validation in the PDF export handler. Administrators should apply the upstream release from the phpMyFAQ repository and follow the remediation guidance in the GitHub Security Advisory GHSA-f8pr-32pp-mp7h.

Workarounds

Place the PDF export route behind an authenticated reverse proxy until the upgrade is deployed.
Add web application firewall rules that rate-limit or block unauthenticated requests to the PDF export path.
Temporarily disable the PDF export feature in the phpMyFAQ configuration if immediate patching is not feasible.

bash

# Nginx example: restrict PDF export to authenticated sessions
location /pdf.php {
    limit_req zone=export burst=5 nodelay;
    auth_request /auth;
    proxy_pass http://phpmyfaq_backend;
}