CVE-2026-76211

Executive Summary

CVE-2026-76211 is a broken access control vulnerability in phpMyFAQ versions prior to 4.1.7. The flaw permits any authenticated user—regardless of their assigned role or privilege level—to read sensitive administrative configuration data through the admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard settings. Because the CONFIGURATION_EDIT permission is not properly enforced on these read endpoints, a low-privileged authenticated attacker can exfiltrate LDAP server topology details (including bind account names and search bases), index statistics, and site analytics. The vulnerability has a CVSS base score of 4.3, reflecting a medium-severity information disclosure that requires authentication but no special privileges and no user interaction. As of this report, no patch evidence has been identified beyond the vendor's release of version 4.1.7, which is the presumed fix version.

Technical Analysis

Vulnerability Mechanism

The vulnerability is a classic case of missing authorization checks (CWE-862) applied to a specific set of API read endpoints. In phpMyFAQ's architecture, administrative operations are guarded by permission checks—specifically the CONFIGURATION_EDIT permission—which is intended to restrict access to configuration-related functionality to users holding that privilege. However, the access control enforcement was applied inconsistently: while write/update endpoints for configuration data correctly verify the caller's permission, the corresponding read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration were left without this check.

The affected endpoints expose data from the following configuration domains:

• LDAP configuration: Server topology, hostnames/IP addresses of directory servers, bind account distinguished names (DNs), bind credentials (potentially the account name, not the password), search bases, and related directory integration settings.
• Elasticsearch configuration: Index names, connection details, and cluster endpoint information.
• OpenSearch configuration: Similar index and cluster metadata.
• Dashboard configuration: Site statistics, user activity analytics, search term frequencies, and other usage telemetry.

The attack surface is the authenticated admin API. By calling these read endpoints with any valid session token or cookie, an attacker with the lowest-privileged account (e.g., a standard user role with no administrative rights) can retrieve the data without triggering any authorization error.

Code-Level Explanation

While the NVD description does not disclose specific function names or endpoint paths, the vulnerability pattern is consistent with a common flaw in PHP MVC applications: the controller method for the "read" action either (a) lacks a permission check entirely, (b) checks the wrong permission constant, or (c) applies the check only in the write handler. The typical pattern is that developers add requirePermission('configuration_edit') to update() methods but forget to add the same guard to get() or read() methods in the same controller.

The missing check allows the request to proceed to the data retrieval phase, where configuration values are pulled from the application's configuration storage (typically a database table or cached configuration array) and serialized to JSON. The response is then returned to the client without verifying whether the requesting user is authorized to view that data.

Technical Limitations

The NVD description provides the vulnerability class and the affected configuration areas but does not enumerate specific API endpoint URLs or parameter names. Therefore, this report does not fabricate exact paths. Network-level detection should focus on anomalous access patterns to admin API paths from low-privileged accounts, as described in the Detection Guidance section.

Exploitation Scenarios

Attack Chain Overview

The exploitation of CVE-2026-76211 follows a low-complexity, authenticated information disclosure chain. No public proof-of-concept has been identified; the chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification

1. An attacker identifies phpMyFAQ instances via Shodan or Google dorks (intitle:"phpMyFAQ", inurl:"/faq/index.php").
2. The attacker fingerprints the version by requesting static assets, reading the meta generator tag in the HTML source, or probing the version endpoint if exposed.
3. Targets running version 4.1.6 or earlier are flagged as potentially vulnerable.

Step 2 — Establish a Valid Session

1. The attacker registers a new standard user account through the public registration form (if enabled), or uses stolen/low-privilege credentials.
2. The attacker authenticates and obtains a valid session cookie. No additional privileges are required—a basic user role suffices.

Step 3 — Trigger the Flaw

1. Using the valid session, the attacker crafts HTTP GET requests to the admin API read endpoints associated with: LDAP configuration, Elasticsearch, OpenSearch, and dashboard analytics.
2. Because the CONFIGURATION_EDIT permission is not enforced on these read endpoints, the server processes the request as if made by an administrator.
3. Each endpoint returns a JSON (or XML) response containing the sensitive configuration data.

Step 4 — Post-Exploitation Impact

1. LDAP data: The attacker obtains directory server hostnames, bind account DNs, search base DNs, and possibly the bind account username. This information directly informs further attacks against the LDAP directory itself:
   • Credential stuffing or brute force against the bind account.
   • LDAP injection attacks if any search fields are later exploitable.
   • Targeted social engineering using known organizational structure from search bases.
2. Elasticsearch/OpenSearch data: Index names and endpoint details enable the attacker to probe those systems directly, potentially exploiting known CVEs in older Elasticsearch/OpenSearch versions or accessing unauthenticated cluster APIs.
3. Dashboard analytics: User activity patterns, search queries, and site traffic statistics can be used to identify high-value targets or map the organization's internal knowledge base structure.

Important Note: No public PoC is available at the time of writing. The attack chain is inferred from the vulnerability class and aligns with standard broken-access-control exploitation methodologies.

Impact Assessment

Business Impact

CVE-2026-76211 results in a confidentiality breach with the following business impacts:

1. LDAP Infrastructure Exposure: LDAP bind account names and server topology reveal the directory infrastructure. In enterprise environments where phpMyFAQ integrates with Active Directory or OpenLDAP, this data could facilitate targeted attacks against the directory service, a critical authentication component.
2. Search Backend Disclosure: Elasticsearch/OpenSearch connection details may include internal hostnames, ports, and cluster names, which aid network reconnaissance and lateral movement within the internal network.
3. Intelligence Gathering: Dashboard analytics reveal search trends, popular topics, and user activity. This can be used to understand organizational focus areas, identify which IT projects are active, or craft phishing lures based on content employees are actively searching for.
4. Regulatory Exposure: If the LDAP search bases or bind account names correlate with personally identifiable information (PII) or classified internal naming schemes, the disclosure could contribute to larger privacy violations.

CVSS Subscore Analysis

• Attack Vector (AV:N): Network-accessible remotely.
• Attack Complexity (AC:L): No special conditions required; the API endpoints operate under standard parameters.
• Privileges Required (PR:L): Low—only a valid authenticated session is needed.
• User Interaction (UI:N): None.
• Scope (S:U): The impact is confined to the phpMyFAQ application itself.
• Confidentiality (C:L): Low confidentiality impact—some sensitive data disclosed, but not all application data.
• Integrity (I:N): No data modification.
• Availability (A:N): No service disruption.

Affected Systems

All phpMyFAQ installations running versions before 4.1.7 that have:

• Admin API endpoints enabled.
• At least one of the following configured: LDAP authentication, Elasticsearch indexing, OpenSearch integration, or dashboard statistics.
• Public user registration enabled (or any route for an attacker to obtain a low-privileged account).

The blast radius is contained to the phpMyFAQ application data itself, but the disclosed configuration details extend the attack surface to adjacent systems (LDAP servers, search clusters).

Detection Guidance

Sigma Rule

title: Suspicious Access to phpMyFAQ Admin Configuration Read Endpoints
id: 6f2d645c-8b5c-4e6f-9e2a-1a3f2c9b4d77
status: experimental
description: Detects access to phpMyFAQ admin API read endpoints for LDAP, Elasticsearch, OpenSearch, or dashboard configuration by users with low privilege levels.
author: ValtersIT Threat Intelligence
date: 2026/05/01
tags:
    - attack.t1078
    - attack.discovery
    - attack.t1087
    - cve.2026.76211
logsource:
    category: web
    product: phpmyfaq
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'admin/api'
            - 'config'
            - 'ldap'
            - 'elasticsearch'
            - 'opensearch'
            - 'dashboard'
            - 'indexStats'
            - 'analytics'
    filter_known_admin:
        cs-username|startswith: 'admin'
        cs-username|contains:
            - 'root'
            - 'superadmin'
    condition: selection and not filter_known_admin
level: medium
falsepositives:
    - Legitimate administrators accessing these endpoints with misconfigured usernames.
    - Helpdesk accounts with elevated permissions.
fields:
    - client_ip
    - cs-username
    - cs-uri-query
    - cs-method

YARA Rule

rule phpMyFAQ_CVE_2026_76211_Config_Disclosure
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects traffic patterns associated with exploitation of CVE-2026-76211 - unauthorized access to admin config read endpoints"
        date = "2026-05-01"
        cve = "CVE-2026-76211"
        severity = "medium"
    strings:
        $s1 = "CONFIGURATION_EDIT" ascii wide nocase
        $s2 = "ldap" ascii wide nocase
        $s3 = "elasticsearch" ascii wide nocase
        $s4 = "opensearch" ascii wide nocase
        $s5 = "dashboard" ascii wide nocase
        $s6 = "searchBase" ascii wide nocase
        $s7 = "bindAccount" ascii wide nocase
        $s8 = "indexStats" ascii wide nocase
        $s9 = "siteAnalytics" ascii wide nocase
    condition:
        (uint16(0) == 0x4D5A or uint32(0) == 0x7F454C46) and
        3 of ($s*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SERVER phpMyFAQ CVE-2026-76211 Unauthorized Admin Config Read";
    flow:established,to_server;
    content:"GET"; http_method;
    content:"/admin/"; http_uri;
    content:"config"; http_uri; nocase;
    content:"!"; http_header; pcre:"/^(?!(ldap|elasticsearch|opensearch|dashboard))/Ui";
    pcre:"/(ldap|elasticsearch|opensearch|dashboard)/Ui";
    classtype:attempted-recon;
    sid:2026076211;
    rev:1;
    reference:cve,2026-76211;
    metadata:created_at 2026-05-01, updated_at 2026-05-01;
)

Note: This rule relies on URI pattern matching combined with a PCRE regex checking for configuration endpoint keywords. Tune the HTTP URI prefix (/admin/) to match the actual phpMyFAQ installation path.

Elastic Detection

// Elastic EQL Query
sequence by source.ip with maxspan=5m
  [ network where event.type == "start" and destination.port == 80 or destination.port == 443
    and network.protocol == "http" and http.request.method == "GET"
    and http.request.body.text contains ""
    and url.path like "*admin*" and url.path like "*config*"
    and (url.path like "*ldap*" or url.path like "*elasticsearch*" or url.path like "*opensearch*"
         or url.path like "*dashboard*")
  ]
  [ authentication where event.outcome == "success"
    and actor.user.roles contains "user" and not actor.user.roles contains "admin"
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%admin%config%")
  AND (like(uri_path, "%ldap%") OR like(uri_path, "%elasticsearch%") OR like(uri_path, "%opensearch%") OR like(uri_path, "%dashboard%"))
  AND method = "GET"
| rex field=uri_path "/(?<endpoint>[^/]+)/$"
| rex field=cookie "session=(?<session_token>[^;]+)"
| rex field=user "user=(?<username>[^\s]+)"
| eval is_privileged = if(match(username, "(?i)admin|root|super"), 1, 0)
| where is_privileged = 0
| stats count BY clientip, username, endpoint, _time
| sort - _time

Wazuh OSSEC Rule

<rule id="986593" level="8">
    <if_sid>31122</if_sid>
    <field name="url">\.admin\.config\.</field>
    <regex>\.(ldap|elasticsearch|opensearch|dashboard)\.</regex>
    <description>CVE-2026-76211 - Unauthorized access to phpMyFAQ admin configuration read endpoints by low-privileged user</description>
    <group>authentication_failures,access_control,phpmyfaq,</group>
    <mitre>
        <id>T1078</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (0/4 confidence) — No vendor security advisory, no CVE-specific patch commit, no release notes confirming a fix, and no third-party patch analysis were identified in the tracked sources. However, the NVD description explicitly states the vulnerability exists "before 4.1.7," which implies that version 4.1.7 is the remediation version. Users should verify the phpMyFAQ changelog for version 4.1.7 directly from the vendor.

Immediate Mitigations

1. Upgrade to phpMyFAQ 4.1.7 or later as the primary and immediate action. If unable to upgrade immediately:
2. Disable public user registration to reduce the attack surface—this removes the easiest path for an attacker to obtain a low-privileged account.
3. Review and revoke unused or stale user accounts, especially those created before the vulnerability was disclosed.
4. Restrict network access to the admin API using a web application firewall (WAF) rule or reverse proxy ACL. Allow only known administrative IP ranges to access any path containing admin/api or configuration endpoint patterns.
5. Implement a WAF rule to block GET requests to admin configuration endpoints from session tokens that do not have the CONFIGURATION_EDIT permission (if the WAF can inspect session roles).

Patch/Upgrade Steps

1. Download phpMyFAQ 4.1.7 from the official vendor site (https://www.phpmyfaq.de).
2. Backup the existing installation: database dump, config/ directory, and any custom templates.
3. Replace the application files, preserving the config/database.php and config/ldap.php files.
4. Run the built-in updater script (if available) or apply the SQL migration scripts from the release package.
5. Purge any cached configuration: clear the PHP opcache and any template caches.
6. Verify that the admin API read endpoints now enforce the CONFIGURATION_EDIT permission by attempting to access them with a low-privileged account.

Long-Term Hardening

1. Apply the principle of least privilege: Audit all existing user roles and ensure that no standard user has any administrative permissions unless explicitly required.
2. Implement proper session monitoring: Log all API access and monitor for anomalous patterns (e.g., a standard user accessing config endpoints).
3. Conduct code review on the access control layer: If using custom forks of phpMyFAQ, ensure that every controller method invoked through the admin API checks a permission before executing.
4. Rotate credentials exposed by the disclosure: If the LDAP bind account name or any secrets may have been exposed, rotate the account credentials and review its access rights in the directory.
5. Maintain an inventory of adjacent systems: Document all LDAP servers, Elasticsearch/OpenSearch clusters, and their connection parameters so that a rapid risk assessment can be performed during future disclosures.

References

1. NVD Entry for CVE-2026-76211: https://nvd.nist.gov/vuln/detail/CVE-2026-76211
2. phpMyFAQ Official Site / Changelog: https://www.phpmyfaq.de/changelog — verify version 4.1.7 release notes for the access control fix.
3. phpMyFAQ GitHub Repository: https://github.com/thorsten/phpMyFAQ — monitor for security-related commits referencing permission enforcement on the admin API.
4. CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html — reference for the vulnerability class.

Threat Actor Activity: No known threat campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-76211 at the time of writing. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Given the authentication requirement and medium severity, it is unlikely to be a primary target for mass exploitation; however, it is a valuable stepping stone for attackers already targeting phpMyFAQ deployments for intelligence gathering.