CVE-2026-24422: 
PHP vulnerability analysis and mitigation

CVE-2026-24422 is an information disclosure vulnerability in phpMyFAQ, an open-source FAQ web application, where multiple public API endpoints improperly expose sensitive user information due to insufficient access controls. Affected versions are 4.0.16 and below; the issue was fixed in version 4.0.17. The vulnerability was published on January 24, 2026, with the security advisory credited to researcher Brahim-Fouad. It carries a CVSS v3.1 base score of 5.3 (Moderate) per the official GitHub advisory, though some sources report a higher score of 7.5 (GitHub Advisory, Feedly).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), stemming from insufficient access controls on public-facing REST API endpoints (GitHub Advisory). Specifically, the OpenQuestionController::list() endpoint invokes Question::getAll() with showAll=true by default, causing records flagged as non-public (isVisible=false) to be returned alongside user email addresses. Similar exposures exist in the comment, news, and FAQ APIs. Exploitation requires no authentication, no special privileges, and no user interaction — a simple unauthenticated HTTP GET request to the affected endpoint (e.g., /api/v3.0/open-questions) is sufficient to trigger the disclosure (GitHub Advisory).

Successful exploitation allows unauthenticated remote attackers to harvest user email addresses from the application's database, enabling targeted phishing or spam campaigns. Additionally, attackers can access content explicitly marked as private or non-public, including hidden questions, comments, news items, and FAQ entries, violating the confidentiality expectations of the application's administrators and users. There is no integrity or availability impact; the vulnerability is purely a confidentiality issue with no evidence of lateral movement potential beyond the phpMyFAQ application itself (GitHub Advisory, Feedly).

A public proof-of-concept (PoC) exploit is available on GitHub at github.com/boroeurnprach/CVE-2026-24422_PoC, and the official advisory itself includes a minimal PoC (curl -i -H 'Accept-Language: en' http://<host>/phpmyfaq/api/v3.0/open-questions) (GitHub Advisory). There is currently no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.009% (0.000090), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify internet-facing phpMyFAQ instances running version 4.0.16 or below using search engines (e.g., Shodan, Censys) or by checking the application's version disclosure on its web interface or API responses.
2. Identify vulnerable endpoints: Target the public REST API endpoints, particularly /api/v3.0/open-questions, as well as comment, news, and FAQ API endpoints that do not enforce visibility controls.
3. Send unauthenticated request: Issue a simple HTTP GET request with an appropriate Accept-Language header, e.g.:

   curl -i -H 'Accept-Language: en' http://<target>/phpmyfaq/api/v3.0/open-questions

4. Harvest disclosed data: Parse the JSON API response to extract user email addresses and records marked as non-public (isVisible=false), which are returned in full despite their intended private status.
5. Repeat for other endpoints: Query additional affected APIs (comments, news, FAQ) to maximize data collection for phishing campaigns or competitive intelligence (GitHub Advisory).

• Network: Unusual or high-volume unauthenticated HTTP GET requests to /api/v3.0/open-questions, /api/v3.0/comments, /api/v3.0/news, or similar phpMyFAQ REST API endpoints from external or unexpected IP addresses.
• Logs: Web server access logs showing repeated requests to phpMyFAQ API endpoints without authentication headers, particularly from automated tools (e.g., curl user-agent strings or scripted request patterns).
• Logs: Abnormal spikes in API response sizes or request frequency to public-facing phpMyFAQ endpoints, which may indicate automated scraping of email addresses or private content.

The primary remediation is to upgrade phpMyFAQ to version 4.0.17 or later, which fixes the improper access controls on the affected API endpoints (GitHub Advisory). For organizations unable to patch immediately, restrict network access to the phpMyFAQ API endpoints (e.g., via firewall rules or web application firewall policies) to prevent unauthenticated external access. Additionally, implementing authentication requirements on public-facing API endpoints at the web server or reverse proxy level can serve as a temporary mitigation until the patch is applied (Feedly).

The vulnerability was reported by researcher Brahim-Fouad and acknowledged by the phpMyFAQ maintainer (Thorsten Rinne) via a GitHub Security Advisory published January 23, 2026 (GitHub Advisory). Coverage has appeared on vulnerability aggregation platforms including Vulners, CVEFeed, and INCIBE-CERT, as well as a dedicated write-up on infinitsec.net. Community reaction has been relatively muted given the moderate severity and straightforward fix, with no notable controversy or widespread alarm observed.