Vulnerability Description
phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and content-health counters regardless of their privilege level.
Related Weaknesses (CWE)
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gpwm-82cg-4wfw
- https://www.vulncheck.com/advisories/phpmyfaq-before-4.2.0-alpha.2-missing-autho
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gpwm-82cg-4wfw
FAQ
What is CVE-2026-85589?
CVE-2026-85589 is a documented vulnerability. phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks...
How severe is CVE-2026-85589?
CVSS scoring is not yet available for CVE-2026-85589. Check NVD for updates.
Is there a patch for CVE-2026-85589?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.