Vulnerabilities

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to…

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

5.3

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-111887 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 3
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to…

   CVSS 6.5 CVE-2026-111910
2. 10
   CVE NVD 14d ago

   phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT…

   CVSS 8.3 CVE-2026-111908
3. 8
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch…

   CVSS 6.5 CVE-2026-111906 Elastic OpenSearch
4. 3
   CVE NVD 14d ago

   phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET…

   CVSS 6.0 CVE-2026-111905
5. 3
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open…

   CVSS 5.3 CVE-2026-111904
6. 3
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ…

   CVSS 5.3 CVE-2026-111902
7. 10
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API…

   CVSS 7.5 CVE-2026-111901
8. 3
   CVE NVD 14d ago

   phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify…

   CVSS 4.3 CVE-2026-111900
9. 22
   CVE NVD 14d ago

   phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by…

   CVSS 7.5 CVE-2026-111898 Red Hat
10. 10
    CVE NVD 14d ago

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments…

    CVSS 7.1 CVE-2026-111897
11. 21
    CVE NVD 14d ago

    phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by…

    CVSS 6.8 CVE-2026-111895 Microsoft
12. 8
    CVE NVD 14d ago

    phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content…

    CVSS 5.4 CVE-2026-111894 Oracle
13. 3
    CVE NVD 14d ago

    phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets…

    CVSS 6.5 CVE-2026-111893
14. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and…

    CVSS 5.5 CVE-2026-111891
15. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right…

    CVSS 5.5 CVE-2026-111890
16. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows…

    CVSS 4.3 CVE-2026-111889
17. 3
    CVE NVD 14d ago

    phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits…

    CVSS 5.5 CVE-2026-111885
18. 10
    CVE NVD 14d ago

    phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control…

    CVSS 8.3 CVE-2026-111884
19. 28
    CVE NVD 14d ago

    phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated…

    CVSS 8.1 CVE-2026-111882 Microsoft Red Hat