What is GHSA-7r9q-gvqq-999j?

GHSA-7r9q-gvqq-999j is a security advisory published by GitHub Security Advisories with Medium severity. phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read...

Which CVE IDs does GHSA-7r9q-gvqq-999j cover?

GHSA-7r9q-gvqq-999j covers the following CVE IDs: CVE-2026-76211. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7r9q-gvqq-999j?

GHSA-7r9q-gvqq-999j has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-7r9q-gvqq-999jMediumCVSS 4.3

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read...

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

August 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-76211 →

📋 Description

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics by calling these endpoints with a valid session.

🔗 References (4)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7gh7-qh7c-9r8m
https://nvd.nist.gov/vuln/detail/CVE-2026-76211
https://www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-admin-api
https://github.com/advisories/GHSA-7r9q-gvqq-999j