GitHub Advisoryadvisory · Packagist

GHSA-j4rc-96xj-gvqc phpMyFAQ: Public API endpoints expose emails and invisible questions

MEDIUM Published 2026-01-23 Modified 2026-01-29 Official page ↗
Aliases
CVE-2026-24422
Ecosystem
Packagist
Packages
phpmyfaq/phpmyfaq, thorsten/phpmyfaq
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-01-23

Affected packages

• Packagist phpmyfaq/phpmyfaq: < 4.0.17 → fixed in 4.0.17 • Packagist thorsten/phpmyfaq: < 4.0.17 → fixed in 4.0.17

Description

Summary Several public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false). Details OpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs. PoC ``` curl -i -H 'Accept-Language: en' \ http://192.168.40.16/phpmyfaq/api/v3.0/open-questions ``` Impact Privacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.

Related

Alias · CVE (1)

  • CVE-2026-24422 phpMyFAQ is an open source FAQ web application. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References