Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

phpMyFAQ reveals registered names and emails

CVE-2026-111887 · published 18 days ago
Summary

The phpMyFAQ software allows anyone to test possible user names and email addresses by submitting a guest comment. A special response tells the tester whether the name or email is already in use, which can help attackers craft targeted phishing messages. Update to the latest version of phpMyFAQ or apply the provided security patch to stop this information leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
thorsten phpmyfaq < 4.1.9
< 4.2.0-beta
Original advisory text
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-204Observable Response Discrepancy
Timeline
Published17 Oct 2026
Updated4 Nov 2026
First seen17 Oct 2026
Sources
CVE-2026-111887 · NVD
CVE-2026-111887 · MITRE
CVE-2026-111887 · OSV
GHSA-pgxw-7c68-83w7 · GHSA
Track software like this
Free during beta