phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted…
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Anthropic
- Product
- Claude, AI / LLM tooling
- CVSS
- 3.3
- Exposure class
- AI infrastructure
Why it ranks 5 (Routine)
- Product class: AI infrastructure
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.