GHSA-mf8r-wm2w-f8c5

phpMyFAQ public FAQ APIs expose inactive FAQ content

Published

2026-08-25

Modified

2026-08-25

Sources

github-advisory

Summary

## Affected Product phpMyFAQ ## Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: current main / 4.2-style source, API v4.0, for `GET /api/v4.0/faqs/tags/{tagId}` when `api.onlyActiveFaqs=true`. ## Patched Versions 4.1.5. ## Description The public FAQ API applies inconsistent `active = 'yes'` filtering across endpoints. A FAQ entry marked `active = 'no'` is hidden from `GET /api/v3.1/faqs/{categoryId}` in phpMyFAQ 4.1.4, but the same inactive FAQ can still be retrieved through public API routes: - `GET /api/v3.1/faq/{categoryId}/{faqId}` returns the inactive FAQ title and full answer. - `GET /api/v3.1/faqs/tags/{tagId}` returns the inactive FAQ title and answer preview. On the current 4.2-style branch, `api.onlyActiveFaqs=true` hides inactive FAQs from list and direct-by-id endpoints, but `GET /api/v4.0/faqs/tags/{tagId}` still returns inactive FAQ title and preview because it calls `Faq::getFaqsByIds()` without active/date filtering. Inactive FAQs are commonly used as drafts or review-only content, so these unauthenticated public API paths may disclose non-public content. ## Root Cause `FaqController::getByCategoryId()` calls `Faq::getAllAvailableFaqsByCategoryId()`, which filters: ```sql fd.date_start = now AND fd.active = 'yes' ``` `FaqController::getByTagId()` instead resolves record IDs through `Tags::getFaqsByTagId()` and then calls `Faq::getFaqsByIds($recordIds)`. `Faq::getFaqsByIds()` filters by record ID, language, and permission, but does not filter `fd.active = 'yes'` or publication date windows before returning `record_title` and `record_preview`. In phpMyFAQ 4.1.4, `FaqController::getById()` calls `Faq::getFaqByIdAndCategoryId()`, which also lacks an inactive/publication-window filter and returns the full answer. ## Proof of Concept The attached PoC uses phpMyFAQ's real Composer autoloader, real public `FaqController`, and a temporary copy of `tests/test.db`. Run from a local phpMyFAQ 4.1.4 source checkout after dependencies are installed and `tests/test.db` exists: ```bash php poc_phpmyfaq_414_inactive_faq_api_exposure.php /path/to/phpMyFAQ-4.1.4 ``` Expected output: ```text phpMyFAQ version: 4.1.4 Inserted FAQ: id=991414, active=no, anonymous-readable, category=991414, tag=991414 GET /api/v3.1/faqs/991414 status: 200 Category response contains inactive title: no GET /api/v3.1/faq/991414/991414 status: 200 Direct-by-id response contains inactive full title+answer: yes GET /api/v3.1/faqs/tags/991414 status: 200 Tag response contains inactive title+preview: yes VERDICT: reproduced inactive FAQ exposure through public API controller paths. ``` ## Suggested Fix Apply one consistent public visibility check across all public FAQ API routes: - `fd.active = 'yes'` - `fd.date_start = now` Suggested implementation options: - Add `Faq::getActiveFaqsByIds(array $faqIds)` and use it in public tag API routes. - Or add an `$onlyActive` / `$publicOnly` argument to `Faq::getFaqsByIds()` and default public controllers to enabled filtering. - Update `Faq::getFaqByIdAndCategoryId()` or the public controller wrapper so inactive records return 404 for unauthenticated public API requests. - Add regression tests with an inactive, anonymous-readable FAQ that has both category and tag relations. ## Reporter Credit Please credit: Yaohui Wang ## CVE Request Because this is unauthenticated exposure of inactive / non-public FAQ content through public API endpoints in a supported release line, please consider assigning a GHSA and requesting a CVE if it meets the project's advisory criteria. ## Full PoC Source ~~~php <?php declare(strict_types=1); /* * PoC for phpMyFAQ 4.1.4 inactive FAQ exposure through public FAQ APIs. * * Usage from a phpMyFAQ 4.1.4 source checkout: * php path/to/poc_phpmyfaq_414_inactive_faq_api_exposure.php /path/to/phpMyFAQ-4.1.4 * * If no path is provided, the current working directory is used. *

Affected packages

Remediation: Upgrade to 4.1.5 or later.

References

• https://github.com/advisories/GHSA-mf8r-wm2w-f8c5