CVE-2026-57994 phpMyFAQ - Information Disclosure of Inactive FAQ Content via Public API Endpoints
Unauthenticated attackers can retrieve inactive or draft FAQ content via public API endpoints due to inconsistent filtering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57994?
CVE-2026-57994 is a medium-severity vulnerability in phpMyFAQ, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content. Specifically, GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer, while GET /api/v3.1/faqs/tags/{tagId} and GET /api/v4.0/faqs/tags/{tagId} return the inactive FAQ title and answer preview, disclosing non-public content.
Weakness: CWE-200
Which versions are affected by CVE-2026-57994?
4 open source packages ship an affected version, including phpmyfaq/phpmyfaq and thorsten/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
phpmyfaq/phpmyfaq Packagist | From 4.1.0 | 4.1.5 |
phpmyfaq/phpmyfaq Packagist | From 4.1.0 | 4.1.5 |
thorsten/phpmyfaq Packagist | From 4.1.0 | 4.1.5 |
thorsten/phpmyfaq Packagist | From 4.1.0 | 4.1.5 |
How do I fix CVE-2026-57994?
Upgrade phpmyfaq/phpmyfaq to 4.1.5 or later.
Is CVE-2026-57994 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57994 exists.
Sources
Also known as GHSA-7582-hcc6-fvcg, GHSA-mf8r-wm2w-f8c5.