CVE-2026-85589 in phpMyFAQ
Summary
by MITRE • 09/04/2026
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and content-health counters regardless of their privilege level.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw resides within phpMyFAQ versions prior to 4.2.0-alpha.2, specifically affecting the administrative dashboard API endpoints designated for searches and content health monitoring. This vulnerability is classified as a Broken Access Control issue, aligning with CWE-862 (Missing Authorization) in the Common Weakness Enumeration standard. The core technical deficiency lies in the implementation of security controls on these specific API routes. While the application correctly enforces authentication by requiring users to be logged in before accessing these endpoints, it fails to implement adequate authorization checks to verify whether the authenticated user possesses the necessary administrative privileges or role-based permissions to perform such actions. Consequently, the system relies solely on the presence of a valid session token rather than validating the specific rights associated with that account against the requested resource operations.
From an operational perspective, this misconfiguration allows any authenticated user, regardless of their assigned privilege level, to access sensitive administrative data. Specifically, attackers can exploit these endpoints to retrieve site-wide search statistics and content-health counters. Although these metrics may appear benign at first glance, they provide valuable reconnaissance information that can aid in further attacks. Search statistics might reveal popular queries or internal terminology used within the organization's documentation, while content health counters could indicate structural weaknesses or outdated sections of the knowledge base. This exposure violates the principle of least privilege and undermines the integrity of the administrative interface by allowing lower-privileged accounts to perform functions reserved for system administrators.
This vulnerability maps directly to MITRE ATT&CK technique T1087 (Account Discovery) when used in conjunction with other enumeration techniques, as it facilitates the gathering of information about the target environment without requiring elevated access rights. The impact extends beyond simple data leakage; it represents a significant breach of trust within the application's security model. By bypassing role-based access controls, an attacker can potentially use this information to refine phishing campaigns or identify high-value targets for more direct exploitation attempts later in the kill chain.
To mitigate this vulnerability, developers must implement strict authorization checks on all administrative API endpoints. This involves verifying that the authenticated user holds a specific role, such as admin or super-admin, before processing any requests related to system-wide statistics or health monitoring. The fix should integrate with the existing authentication middleware but add an additional layer of permission validation. Furthermore, it is recommended to conduct a comprehensive audit of all API endpoints in phpMyFAQ to ensure that no other routes suffer from similar missing authorization flaws. Regular security testing and code reviews focusing on access control logic are essential to prevent recurrence of such issues in future releases.