CVE-2026-111887 Details
Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
An account enumeration vulnerability has been identified in phpMyFAQ versions prior to 4.1.9 and in the 4.2.0-alpha release, through 4.2.0-beta. This vulnerability allows unauthenticated attackers to verify registered display names and email addresses by exploiting a unique HTTP 409 response. Attackers can send guest comments to the comment creation endpoint, using candidate names and email values to associate display names with email addresses, potentially leading to targeted phishing attacks.
As a temporary measure, phpMyFAQ administrators can disable guest comments or, if the GD extension is available, keep the CAPTCHA enabled to increase the difficulty of automated probing. However, a permanent fix should involve modifying the comment endpoint to prevent the disclosure of account existence checks for unauthenticated users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgxw-7c68-83w7 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-account-enumeration-via-guest-comment-endpoint | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.0.0, <= 4.1.8 (semver) >= 4.2.0-alpha, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |