CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions

What is CVE-2026-24422?

CVE-2026-24422 is a medium-severity vulnerability in Phpmyfaq Phpmyfaq, published on 24 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17.

Weakness: CWE-200

Which versions are affected by CVE-2026-24422?

4 open source packages ship an affected version, including phpmyfaq/phpmyfaq and thorsten/phpmyfaq. It affects 1 product.

Products include Phpmyfaq Phpmyfaq.

How do I fix CVE-2026-24422?

Upgrade phpmyfaq/phpmyfaq to 4.0.17 or later.

Is CVE-2026-24422 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24422 exists.

Other vulnerabilities in Phpmyfaq Phpmyfaq

• CVE-2023-0310 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq Critical 9.8
• CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq Critical 9.8
• CVE-2017-11187 Security feature bypass in n/a Critical 9.8
• CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle Critical 9.1
• CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge Critical 9.1

All Phpmyfaq Phpmyfaq vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j4rc-96xj-gvqc.