CVE-2026-76211
Received Received - Intake

phpMyFAQ Admin API Information Disclosure via Missing Permission Checks

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76211
EUVD
EUVD-2026-62452

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

phpMyFAQ before version 4.1.7 has a vulnerability where certain admin API read endpoints do not enforce the CONFIGURATION_EDIT permission. This allows any authenticated user to access sensitive administrative data like LDAP server details, Elasticsearch/OpenSearch statistics, and site analytics by calling these endpoints with a valid session.

Detection Guidance
  • Check phpMyFAQ admin API endpoints for unauthorized access by sending authenticated requests to LDAP, Elasticsearch, OpenSearch, and dashboard configuration endpoints and verifying if sensitive data is returned without proper CONFIGURATION_EDIT permission.
  • Use curl to test endpoints like /api/admin/ldap-config, /api/admin/elasticsearch-stats, /api/admin/opensearch-stats, and /api/admin/dashboard with a valid session cookie to see if configuration details are exposed.
  • Review server logs for repeated access attempts to these admin API endpoints by non-admin users.
Impact Analysis

An attacker with a valid account could exploit this to gather internal system information such as LDAP directory topology or search index details. This data could be used to plan further attacks, though the impact is limited since the endpoints are read-only.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by exposing sensitive administrative data such as LDAP server details, bind account names, and search bases. Unauthorized access to such information may lead to breaches of confidentiality requirements under these regulations.

Mitigation Strategies
  • Upgrade phpMyFAQ to version 4.1.7 or later to ensure proper authorization checks are enforced on all admin API endpoints.
  • Audit and restrict access to admin API endpoints by implementing role-based access control and ensuring only authorized users can access CONFIGURATION_EDIT permissions.
  • Monitor network traffic for suspicious requests to these endpoints and block unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart