Vulnerabilities CVE-2026-76215

CVE-2026-76215

Medium

Open

TLP:CLEAR

phpMyFAQ before 4.1.7 Missing Authorization via child resources

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

Details

CVSS Score: 6.9
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 19, 2026
Last Modified: Aug 21, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.