CVE-2026-85589: phpMyFAQ Authorization Bypass Vulnerability

CVE-2026-85589 Overview

CVE-2026-85589 is a missing authorization vulnerability [CWE-862] in phpMyFAQ versions before 4.2.0-alpha.2. The flaw affects two admin dashboard API endpoints, searches and content-health, which enforce authentication but skip permission checks. Any authenticated user, regardless of assigned role or privilege level, can query these endpoints and retrieve site-wide search statistics and content-health counters. The issue exposes internal operational data that should be restricted to administrators.

Critical Impact
Low-privileged authenticated users can read administrative dashboard data, including search analytics and content-health metrics, without any elevated permissions.

Affected Products

phpMyFAQ versions prior to 4.2.0-alpha.2
Admin dashboard API endpoint: searches
Admin dashboard API endpoint: content-health

Discovery Timeline

2026-09-04 - CVE-2026-85589 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85589

Vulnerability Analysis

phpMyFAQ exposes several JSON API endpoints under the admin dashboard for reporting purposes. Two of these endpoints, searches and content-health, wrap their handlers with an authentication check but omit the role or permission check applied elsewhere in the admin area. As a result, the endpoints treat every authenticated session as authorized to view operational analytics.

The searches endpoint returns aggregated site-wide search queries and counters. The content-health endpoint returns FAQ content status metrics such as stale, orphaned, or unreviewed items. Neither dataset is intended for standard users. Exposing them to any registered account gives attackers reconnaissance data about site usage patterns, popular queries, and internal content quality.

The issue is classified under CWE-862: Missing Authorization. It is a horizontal and vertical access control failure limited to information disclosure. Integrity and availability are not affected.

Root Cause

The root cause is an incomplete access control chain in the dashboard controller. The endpoints validate the presence of an authenticated session but do not invoke the permission service that gates other admin routes. Developers relied on authentication as an implicit authorization boundary, which is insufficient in a multi-role application.

Attack Vector

An attacker requires a valid low-privilege phpMyFAQ account. After logging in, the attacker issues authenticated HTTP GET requests to the vulnerable dashboard API endpoints. The server responds with the same JSON payloads that would be returned to an administrator. No exploit code, chained vulnerability, or user interaction is required.

Exploitation is straightforward and can be performed with any HTTP client that carries the session cookie. Refer to the GitHub Security Advisory GHSA-gpwm-82cg-4wfw for technical details.

Detection Methods for CVE-2026-85589

Indicators of Compromise

Authenticated HTTP requests from non-admin user sessions to the searches or content-health dashboard API endpoints.
Repeated JSON responses to low-privilege accounts containing site-wide analytics fields.
Unusual volume of API calls originating from user accounts that historically access only public FAQ pages.

Detection Strategies

Review phpMyFAQ web server access logs for requests to the vulnerable dashboard endpoints and correlate the requesting user ID with the account's role.
Enable application-level audit logging for admin API routes and alert when non-admin roles receive HTTP 200 responses.
Deploy web application firewall (WAF) rules to log or block access to the dashboard API paths when the request originates from sessions lacking an admin role claim.

Monitoring Recommendations

Baseline expected consumers of the dashboard API and alert on new user IDs querying those routes.
Monitor for enumeration patterns such as rapid sequential requests to multiple dashboard endpoints from a single session.
Forward phpMyFAQ application logs to a centralized analytics platform to enable role-versus-endpoint correlation searches.

How to Mitigate CVE-2026-85589

Immediate Actions Required

Upgrade phpMyFAQ to version 4.2.0-alpha.2 or later, which enforces permission checks on the affected endpoints.
Audit existing user accounts and disable or downgrade any accounts that no longer require access.
Rotate session tokens after upgrading to invalidate sessions that may have been used to probe the endpoints.

Patch Information

The maintainers fixed the vulnerability in phpMyFAQ 4.2.0-alpha.2 by adding permission checks to the searches and content-health dashboard API handlers. Patch details are published in the GitHub Security Advisory and the VulnCheck Advisory on phpMyFAQ.

Workarounds

Restrict access to the /admin/ path at the web server or reverse proxy layer to trusted administrator IP ranges until the patch is applied.
Add a WAF rule that blocks requests to the vulnerable dashboard API endpoints unless the request session carries an admin role indicator.
Temporarily disable self-registration to prevent untrusted users from obtaining the authenticated session needed for exploitation.

bash

# Example nginx configuration to restrict admin dashboard API endpoints
location ~ ^/admin/api/dashboard/(searches|content-health) {
    allow 10.0.0.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://phpmyfaq_backend;
}