5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24422

CVE-2026-24422: phpMyFAQ: Public API endpoints expose emails and invisible questions

phpMyFAQ is an open source FAQ web application. In versions 4.0.16 and below, multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. The OpenQuestionController::list() endpoint calls Question::getAll() with showAll=true by default, returning records marked as non-public (isVisible=false) along with user email addresses, with similar exposures present in comment, news, and FAQ APIs. This information disclosure vulnerability could enable attackers to harvest email addresses for phishing campaigns or access content that was explicitly marked as private. This issue has been fixed in version 4.0.17.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24422

CVE-2026-24422:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
phpmyfaq/phpmyfaq	composer	<= 4.0.16	4.0.17
thorsten/phpmyfaq	composer	<= 4.0.16	4.0.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several public API endpoints that expose non-public information. The analysis focused on the commits between the vulnerable version 4.0.16 and the patched version 4.0.17. The key commit 0ef9f3eaf2f41d58cbe92187c7c7ccd4369cf50a provided clear evidence of the vulnerability and its fix. The patch modified the OpenQuestionController::list() method, changing the call from $question->getAll() to $question->getAll(false). This directly corresponds to the vulnerability description, which states that OpenQuestionController::list() was calling Question::getAll() with the default showAll=true, leading to the exposure of invisible questions. The identified vulnerable function, phpMyFAQ\Controller\Api\OpenQuestionController::list, is the entry point for the reported exploit PoC. While the advisory mentions similar issues in other API endpoints (comment, news, faq), no corresponding patches were found in the analyzed commit range. Therefore, the analysis is confined to the function with direct evidence.

Vulnerable functions

phpMyFAQ\Controller\Api\OpenQuestionController::list

phpmyfaq/src/phpMyFAQ/Controller/Api/OpenQuestionController.php

The `list` method in `OpenQuestionController` called `Question::getAll()` without parameters. The default behavior of `getAll()` was to return all questions, including those marked as not visible. This exposed non-public questions and associated email addresses through the public API. The patch corrects this by passing `false` to `getAll()`, ensuring only visible questions are returned.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.