CVE-2026-111887
Deferred Deferred - Pending Action

Account Enumeration in phpMyFAQ via HTTP 409 Response

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111887
EUVD
EUVD-2026-103332

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an account enumeration flaw in phpMyFAQ versions before 4.1.9 and 4.2.0-beta. It allows unauthenticated attackers to confirm registered display names and emails by submitting guest comments with candidate values. The application returns a distinct HTTP 409 response only when both the display name and email match existing accounts, enabling attackers to link names to emails for phishing.

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the phpMyFAQ guest comment endpoint. Send test requests with candidate display names and emails. A distinct HTTP 409 Conflict response indicates a match, while other status codes (200, 400, 403, 404) suggest no match. Automate this with tools like curl or Burp Suite to check for account enumeration.

Impact Analysis

Attackers can use this flaw to identify valid accounts and associate display names with emails. This enables targeted phishing attacks, credential-stuffing attempts, and deanonymization of users. The vulnerability does not directly compromise data integrity or availability but facilitates social engineering and reconnaissance for further attacks.

Compliance Impact

This vulnerability enables attackers to link display names to email addresses through account enumeration, which could facilitate phishing attacks. This may violate data protection principles under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., Security Rule safeguards for protected health information) by exposing personal data and increasing risks of unauthorized access or breaches.

Mitigation Strategies

Immediately upgrade phpMyFAQ to versions 4.1.9 or later. Disable guest comments in the admin panel or enable CAPTCHA for comment submissions. If upgrading is not possible, restrict access to the comment endpoint via firewall rules or web application firewall (WAF) rules to block unauthorized requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart