Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108851phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool

Low 3.3

In plain English

A low-severity missing authorization in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 95.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	4.1.0 – through 4.1.10

Weakness: CWE-862 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility third-party-advisory
https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php#L137-L194 technical-description
https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php#L56-L102 technical-description
https://github.com/thorsten/phpMyFAQ product
VulnCheck Advisory: phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool third-party-advisory