GHSA-j4rc-96xj-gvqcMediumCVSS 5.3

phpMyFAQ: Public API endpoints expose emails and invisible questions

Published
January 23, 2026
Last Modified
January 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-24422 →

📋 Description

Summary

Several public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false).

Details

OpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs.

PoC

curl -i -H 'Accept-Language: en' \
  http://192.168.40.16/phpmyfaq/api/v3.0/open-questions

Impact

Privacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.

🎯 Affected products2

  • composer/phpmyfaq/phpmyfaq:<= 4.0.16
  • composer/thorsten/phpmyfaq:<= 4.0.16

🔗 References (3)