CVE-2026-24422

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24422", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-22T18:19:49.175Z", "datePublished": "2026-01-24T02:02:30.588Z", "dateUpdated": "2026-01-26T14:58:18.883Z"}, "containers": {"cna": {"title": "phpMyFAQ: Public API endpoints expose emails and invisible questions", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqc"}], "affected": [{"vendor": "thorsten", "product": "phpMyFAQ", "versions": [{"version": "< 4.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-24T02:02:30.588Z"}, "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17."}], "source": {"advisory": "GHSA-j4rc-96xj-gvqc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T14:57:47.560338Z", "id": "CVE-2026-24422", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T14:58:18.883Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24422", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-22T18:19:49.175Z", "datePublished": "2026-01-24T02:02:30.588Z", "dateUpdated": "2026-01-26T14:58:18.883Z"}, "containers": {"cna": {"title": "phpMyFAQ: Public API endpoints expose emails and invisible questions", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqc"}], "affected": [{"vendor": "thorsten", "product": "phpMyFAQ", "versions": [{"version": "< 4.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-24T02:02:30.588Z"}, "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17."}], "source": {"advisory": "GHSA-j4rc-96xj-gvqc", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24422", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T14:57:47.560338Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T14:58:03.677Z"}}]}}

{"affected": [{"affectedData": [{"product": "phpMyFAQ", "vendor": "thorsten", "versions": [{"status": "affected", "version": "< 4.0.17"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A48918B-2C09-403F-A8A5-8179AE32363E", "versionEndExcluding": "4.0.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17."}, {"lang": "es", "value": "phpMyFAQ es una aplicaci\u00f3n web de preguntas frecuentes de c\u00f3digo abierto. En las versiones 4.0.16 e inferiores, m\u00faltiples puntos finales de API p\u00fablicos exponen indebidamente informaci\u00f3n sensible del usuario debido a controles de acceso insuficientes. El punto final OpenQuestionController::list() llama a Question::getAll() con showAll=true por defecto, devolviendo registros marcados como no p\u00fablicos (isVisible=false) junto con las direcciones de correo electr\u00f3nico de los usuarios, con exposiciones similares presentes en las API de comentarios, noticias y preguntas frecuentes. Esta vulnerabilidad de revelaci\u00f3n de informaci\u00f3n podr\u00eda permitir a los atacantes recolectar direcciones de correo electr\u00f3nico para campa\u00f1as de phishing o acceder a contenido que fue expl\u00edcitamente marcado como privado. Este problema ha sido solucionado en la versi\u00f3n 4.0.17."}], "id": "CVE-2026-24422", "lastModified": "2026-06-17T10:23:02.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24422", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T14:57:47.560338Z", "version": "2.0.3"}}]}, "published": "2026-01-24T03:16:01.010", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:55:39.312921+00:00", "value": {"mitigation_remediation": ["Upgrade to phpMyFAQ 4.0.17 or later, which removes the insecure default behaviour.", "Restrict access to the public API endpoints by placing them behind authentication or adjusting firewall rules, so only authorized users can query sensitive data.", "Review and harden the application\u2019s access\u2011control configuration, ensuring that non\u2011public data is never exposed through unprotected API calls."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected software is Thorsten\u2019s phpMyFAQ application. Versions 4.0.16 and earlier are vulnerable; the issue was resolved in version 4.0.17. The product is distributed under the cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:* identifier.", "description_and_impact": "The vulnerability resides in phpMyFAQ 4.0.16 and earlier, where several publicly exposed API endpoints lack proper access checks. The OpenQuestionController::list() method calls Question::getAll() with showAll=true by default, returning items marked as non-public (isVisible=false) and attaching the corresponding user email addresses. Similar weaknesses exist in comment, news, and FAQ APIs. Consequently, an unauthenticated attacker can retrieve private question data and email addresses, facilitating phishing or other social engineering attacks. The weakness aligns with CWE\u2011200, a data\u2011exposure flaw.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates moderate severity. With an EPSS score below 1\u202f% the current economic exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw is reachable through publicly available API URLs that do not require authentication, so an attacker could automatically harvest email addresses or private content by simply invoking those endpoints. Mitigating this risk requires applying the vendor\u2019s patch or restricting unauthenticated API access."}}}}, "created": "2026-01-26T11:48:42.855024+00:00", "updated": "2026-04-18T03:00:10.331592+00:00", "vendors": ["thorsten", "thorsten$PRODUCT$phpmyfaq"]}