CVE-2026-108851

EUVD-2026-97002
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 0.86%
Common Weakness Enumeration
References
https://github.com/thorsten/phpMyFAQ
https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php#L137-L194
https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php#L56-L102
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility
https://www.vulncheck.com/advisories/phpmyfaq-through-4.1.10-missing-authorization-via-mcp-server-faq-search-tool