Is CVE-2026-76215 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-76215?

CVE-2026-76215 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-76215

Description

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by querying the comments and attachments API endpoints.