CVE-2026-76206
Received Received - Intake

phpMyFAQ PDF Export Unauthenticated Draft Access

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-update timestamps of inactive or unpublished FAQs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76206
EUVD
EUVD-2026-62447

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.7 (exc)
phpmyfaq phpmyfaq 4.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ versions before 4.1.7 have an information disclosure vulnerability in the PDF export feature. The application does not check if FAQ entries are active before allowing access to their metadata. Unauthenticated attackers can exploit this by using sequential FAQ IDs to retrieve titles, solution IDs, author names, and last-update timestamps of unpublished or draft FAQs.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to the PDF export endpoint (/pdf-export) with sequential FAQ IDs. Check server logs for repeated requests to this endpoint without authentication. Use tools like curl to test the endpoint manually with different FAQ IDs to see if inactive entries' metadata is exposed.

Impact Analysis

Attackers can access sensitive metadata about inactive FAQs, including titles and author details, which may reveal unpublished content plans or internal processes. While the actual FAQ content is redacted, the exposed metadata could aid in further attacks or data reconnaissance.

Compliance Impact

This vulnerability may lead to unauthorized access to sensitive metadata, potentially violating data protection requirements under GDPR or HIPAA if such metadata relates to personal or protected health information. Exposure of draft or inactive content details could indicate inadequate access controls.

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.1.7 or later to patch the vulnerability. If an upgrade is not possible, restrict access to the PDF export endpoint by implementing authentication checks or IP whitelisting. Ensure the active-status validation is applied to the PDF export route, matching the JSON API's behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart