CVE-2026-111904 phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
Unauthenticated attackers can read hidden internal questions and usernames via the open-questions API due to a logic error.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111904?
CVE-2026-111904 is a medium-severity vulnerability in thorsten phpMyFAQ, published on 17 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. Attackers can send GET requests to the /api/v4.0/open-questions endpoint to retrieve non-public moderation or internal questions and their associated usernames.
Weakness: CWE-200
Which versions are affected by CVE-2026-111904?
How do I fix CVE-2026-111904?
No fix has been published for CVE-2026-111904 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111904 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111904 exists.
Sources
Also known as GHSA-6xm9-p734-8fx6, GHSA-xmh2-49v9-xw88.