CVE-2026-111887 in phpMyFAQ
Summary
by MITRE • 10/17/2026
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The identified security flaw resides in phpMyFAQ versions prior to 4.1.9 and specifically within the development branch leading up to version 4.2.0-beta, representing a critical information disclosure vulnerability that undermines user privacy and facilitates further attacks. This account enumeration issue stems from improper handling of input validation during the guest comment submission process. When an unauthenticated attacker attempts to submit a comment using email addresses or display names associated with existing registered users, the application fails to mask this conflict appropriately. Instead of returning a generic success or failure message that would obscure whether the user exists, the system returns a distinct HTTP 409 Conflict status code. This specific response acts as a reliable oracle for attackers, allowing them to definitively confirm which email addresses and display names are registered within the application database without needing valid credentials.
The operational impact of this vulnerability extends beyond simple data leakage, serving primarily as an initial vector for more sophisticated social engineering campaigns. By leveraging the distinct HTTP 409 response, malicious actors can systematically enumerate valid user identities through automated scripts that submit varying guest comment payloads to the affected endpoint. Once a correlation is established between specific display names and email addresses, attackers gain precise targeting capabilities for phishing attacks. This enriched contextual data allows threat actors to craft highly convincing spear-phishing messages that appear legitimate because they reference accurate personal details of the victim. The ability to link identities directly to communication channels significantly lowers the barrier for successful credential harvesting or malware delivery via social engineering tactics.
From a classification perspective, this vulnerability aligns with CWE-204, which defines observable response discrepancy as an indicator of sensitive information exposure, and falls under the ATT&CK technique T1589.001, specifically Gather Victim Identity Information: Email Addresses. The flaw represents a classic case where application logic exposes internal state through side-channel indicators such as HTTP status codes rather than direct data leakage in the response body. This method of enumeration is particularly dangerous because it can often bypass basic web application firewalls that do not inspect semantic differences between error responses for different types of validation failures.
Mitigation requires an immediate upgrade to phpMyFAQ version 4.1.9 or later, where this logic has been corrected to ensure consistent response behavior regardless of whether the submitted email or name corresponds to a registered user. For organizations unable to patch immediately due to operational constraints, implementing a WAF rule that normalizes HTTP status codes for comment submission endpoints can provide temporary relief by masking the 409 distinction from external clients. Additionally, developers should review other input validation points in the application to ensure they do not leak information through timing differences or varying error messages, adhering to the principle of least privilege and consistent feedback mechanisms to prevent future enumeration attacks.