Medium severity5.3NVD Advisory· Published Aug 19, 2026· Updated Sep 1, 2026
CVE-2026-76206
CVE-2026-76206
Description
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-update timestamps of inactive or unpublished FAQs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <4.1.7
Patches
Vulnerability mechanics
References
2- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f8pr-32pp-mp7hnvdMitigationVendor Advisory
- www.vulncheck.com/advisories/phpmyfaq-before-information-disclosure-via-pdf-exportnvdThird Party Advisory
News mentions
1- PhpMyFAQ: 14 Vulnerabilities Including Auth Bypass Patched in Single DisclosureVypr Intelligence · Aug 19, 2026