https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T07:21:07.428493+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-76215 CVE-2026-76215 — phpMyFAQ before 4.1.7 Missing Authorization via child resources 2026-10-04T07:21:11.221703+00:00

Affected: thorsten phpMyFAQ

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.