CVE-2026-76215

5.3 Moyenne

Publiée le 19/08/2026 à 16:17 · Modifiée le 01/09/2026 à 17:20 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq ExploitMitigationVendor Advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-missing-authorization-via-child-resources Third Party Advisory
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jmv9-23mw-mxpq ExploitMitigationVendor Advisory

CVE-2026-76215

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs