Security readout for executives and security teams
Plain-English summary
CVE-2026-24422 affects phpMyFAQ versions 4.0.16 and earlier. Public API endpoints can expose user email addresses and FAQ content marked non-public. The main business risk is information leakage that could support phishing or reveal private draft/internal questions. The vendor advisory states the issue is fixed in version 4.0.17.
Executive priority
Treat as a near-term remediation item, especially for public phpMyFAQ sites. The issue is not described as actively exploited and has moderate CVSS severity, but it can expose emails and private content. Upgrade during the next scheduled security maintenance window, sooner if sensitive internal content is stored in phpMyFAQ.
Technical view
The vulnerability is an improper access control information disclosure issue, classified as CWE-200. Public API endpoints, including OpenQuestionController::list(), may return records intended to be hidden because Question::getAll() is called with showAll=true by default. Similar exposure is reported in comment, news, and FAQ APIs. CVSS is 5.3: network-accessible, low complexity, no authentication required, confidentiality impact only.
Likely exposure
Organizations running internet-accessible phpMyFAQ versions below 4.0.17 are the likely exposure group. Risk is higher where public APIs contain user emails, unpublished questions, private content, comments, news, or FAQ data that should not be visible anonymously.
Exploitation context
Sources do not report active exploitation, and the CVE is not listed as CISA KEV in the provided data. Exploitation would require only network access to affected public API endpoints, but the documented impact is limited to information disclosure, not code execution or service disruption.
Researcher notes
The public advisory identifies multiple API exposure paths but the provided evidence centers on information disclosure. Do not assume broader compromise without separate findings. Validation should focus on version confirmation, anonymous API reachability, and whether non-public records or email addresses are returned in affected deployments.
Mitigation direction
- Upgrade phpMyFAQ to version 4.0.17 or later.
- Review vendor advisory GHSA-j4rc-96xj-gvqc for current guidance.
- Restrict public API exposure where business requirements allow.
- Review exposed FAQ, news, comment, and question data for sensitive content.
Validation and detection
- Inventory phpMyFAQ deployments and identify versions below 4.0.17.
- Confirm whether affected public API endpoints are reachable anonymously.
- Review API responses for emails or non-public content exposure.
- Check logs for unusual anonymous API enumeration patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24422 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j4rc-96xj-gvqcCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.