CVE-2026-85589 — phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication wi…
Published: 2026-09-04 · CVSS: 5.3 · CVSS 4.0
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and content-health counters regardless of their privilege level.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7