CVE-2026-46366 in phpMyFAQ
Summary
by MITRE • 05/15/2026
phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() method that lacks permission filtering, allowing unauthenticated attackers to enumerate restricted FAQ entries and read their titles via the /solution_id_{id}.html endpoint. Attackers can sequentially iterate solution IDs to discover all FAQs including those restricted to specific users or groups, leaking sensitive metadata through redirect Location headers and page canonical links.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability in phpMyFAQ versions prior to 412 represents a critical information disclosure flaw that undermines the platform's access control mechanisms. This weakness resides within the getIdFromSolutionId() method where proper authentication and authorization checks are absent, creating an exploitable path for unauthenticated threat actors to bypass intended security boundaries. The vulnerability specifically affects the /solution_id_{id}.html endpoint which serves as a gateway for accessing FAQ entries through solution identifiers rather than traditional category-based navigation.
The technical implementation flaw stems from insufficient input validation and permission filtering within the application's core logic. When attackers make requests to the solution_id_{id}.html endpoint, the system fails to verify whether the requesting entity has proper authorization to access the specific FAQ entry. This absence of access control validation allows sequential enumeration of solution IDs, enabling attackers to systematically discover and retrieve information about restricted FAQ entries that should only be visible to authenticated users or specific user groups. The vulnerability operates at the application layer, specifically targeting the web application's authorization framework rather than exploiting network-level weaknesses.
The operational impact of this vulnerability extends beyond simple information leakage to potentially expose sensitive organizational data and internal knowledge structures. Attackers can leverage this flaw to map the complete FAQ database structure, identifying not only the existence of restricted content but also gathering metadata through redirect Location headers and canonical links embedded in the HTTP responses. This metadata exposure provides attackers with insights into the organization's information architecture, potentially revealing business-critical knowledge about internal processes, technical implementations, or sensitive operational details. The vulnerability essentially transforms the access control system into a passive reconnaissance tool that leaks information about restricted content without requiring any authentication credentials.
Security practitioners should recognize this vulnerability as a variant of CWE-284 Access Control Issues, specifically manifesting as insufficient access control within web applications. The flaw aligns with ATT&CK technique T1213 Data from Information Repositories, where adversaries collect information from repositories that should be protected. Organizations should implement immediate mitigations including enforcing proper authentication checks in the getIdFromSolutionId() method, implementing rate limiting on solution ID enumeration attempts, and ensuring that all endpoint access is properly validated against user permissions. The most effective solution involves patching to version 412 or later where proper access control mechanisms have been implemented to prevent unauthorized enumeration of restricted FAQ entries.