CVE-2026-76215CWE-862broken-access-control

CVE-2026-76215

Medium · published August 19, 2026

CVSS v3.1

5.3

EPSS

Percentile

27.5

In the wild

Unconfirmed

What it is

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00350 · 27.5th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-19T18:17Z

Affected products (1)

Product	Versions	Fixed in
phpmyfaq/phpmyfaq	< 4.1.7	4.1.7

References (3)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq · [email protected]https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resources · [email protected]https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 AUG 14:02Z
phpMyFAQ before 4.1.7 Missing Authorization via child resources
cvelistv5