CVE-2026-76211 in phpMyFAQ
Summary
by MITRE • 08/19/2026
phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in phpMyFAQ versions prior to 4.1.7 represents a critical failure in access control mechanisms within the administrative application programming interface. Specifically, the system fails to properly enforce the CONFIGURATION_EDIT permission when handling read requests for sensitive configuration endpoints related to LDAP integration, Elasticsearch and OpenSearch indexing settings, as well as dashboard analytics data. This flaw allows any authenticated user who possesses a valid session token or cookie to bypass intended authorization checks and retrieve highly confidential administrative information that should be restricted to users with elevated privileges. The core technical issue lies in the server-side logic which validates authentication status but neglects to verify whether the requesting user holds the specific CONFIGURATION_EDIT permission required for accessing these particular API routes, effectively treating all authenticated sessions as equivalent regarding access rights to configuration data.
The operational impact of this vulnerability is severe due to the nature of the exposed information. Attackers can extract LDAP server topology details including bind account names and search bases, which are critical components for directory service authentication configurations. Additionally, they can retrieve Elasticsearch or OpenSearch index statistics and site analytics from the dashboard endpoints. The disclosure of LDAP bind credentials and search base structures significantly aids attackers in planning targeted attacks against the organization's identity infrastructure, potentially facilitating unauthorized access to user accounts or privilege escalation within the directory services. Furthermore, exposure of internal indexing configurations may reveal details about data storage architectures that could be leveraged for further exploitation attempts against backend systems.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and falls under MITRE ATT&CK technique T1078 Valid Accounts, as it involves the misuse of legitimate credentials to access restricted resources. The flaw is particularly dangerous because it does not require complex exploitation techniques or unauthenticated access; instead, it relies on a simple logic error in permission validation that can be triggered by any user who has successfully authenticated to the application. This makes automated scanning and exploitation straightforward for malicious actors who have obtained valid credentials through phishing, credential stuffing, or other means of account compromise.
Mitigation strategies must prioritize immediate patching to version 4.1.7 or later where this permission check is correctly implemented on all affected API endpoints. In environments where upgrading is not immediately feasible, network-level controls such as web application firewalls can be configured to restrict access to these specific administrative API paths based on IP whitelisting if the administration interface is exposed externally. Additionally, organizations should enforce strict session management policies including short-lived tokens and multi-factor authentication for all administrative accounts to reduce the window of opportunity for attackers who may have obtained valid credentials. Regular auditing of user permissions and role assignments within phpMyFAQ is also recommended to ensure that least privilege principles are maintained across all functional areas of the application.