Why does GHSA-p26v-fx3x-r2rp have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-p26v-fx3x-r2rp?

GHSA-p26v-fx3x-r2rp has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-p26v-fx3x-r2rp?

GHSA-p26v-fx3x-r2rp affects 2 products, including: composer/thorsten/phpmyfaq:\u003c 4.1.2; composer/phpmyfaq/phpmyfaq:\u003c 4.1.2.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 9, 2026

GHSA-p26v-fx3x-r2rpMediumCVSS 4.3Disclosed before NVD

Duplicate Advisory: phpMyFAQ's Missing CONFIGURATION_EDIT Permission Check on 12 Admin API Configuration Tab Endpoints Allows Information Disclosure by Any Authenticated User

Vendor

GitHub Security Advisories

Published

May 15, 2026

Last Modified

June 9, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-pqh6-8fxf-jx22. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CONFIGURATION_EDIT). Any authenticated user can enumerate system configuration metadata including permission model, cache backend, mail provider, and translation provider by querying /admin/api/configuration endpoints, violating least privilege access control.

🎯 Affected products2

composer/thorsten/phpmyfaq:< 4.1.2
composer/phpmyfaq/phpmyfaq:< 4.1.2

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products2

🔗 References (4)