Medium severity5.3NVD Advisory· Published Oct 17, 2026· Updated Oct 17, 2026

CVE-2026-111887

Description

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

PhpMyAdmin/Phpmyfaqllm-create
Range: <4.1.9, <4.2.0-beta

Patches

Vulnerability mechanics

References

github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7nvd
www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-account-enumeration-via-guest-comment-endpointnvd

News mentions

PhpMyFAQ: 25 Vulnerabilities Including Critical Auth Bypass Disclosed Together
Vypr Intelligence · Oct 17, 2026

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000