What is CVE-2026-76206?

CVE-2026-76206 is a medium-severity vulnerability in Thorsten Phpmyfaq, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-08-19.

How severe is CVE-2026-76206?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Information disclosure in Thorsten Phpmyfaq

CVE-2026-76206

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-update timestamps of inactive or unpublished FAQs.

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Thorsten Phpmyfaq

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-76206?: CVE-2026-76206 is a medium-severity vulnerability in Thorsten Phpmyfaq, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-08-19.
How severe is CVE-2026-76206?: Medium severity. CVSS v3 base score is 5.3 out of 10.