GHSA-j4rc-96xj-gvqc — phpMyFAQ: Public API endpoints expose emails and invisible questions

The advisory, in context

Summary

Several public API endpoints return email addresses and non‑public records (e.g. open questions with isVisible=false).

Details

OpenQuestionController::list() calls Question::getAll() with the default showAll=true, returning invisible questions and their emails. Similar exposures exist in comment/news/faq APIs.

PoC

curl -i -H 'Accept-Language: en' \
  http://192.168.40.16/phpmyfaq/api/v3.0/open-questions

Impact

Privacy exposure of email addresses and non‑public content; increased risk of phishing/scraping.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

phpmyfaq/phpmyfaq Packagist

Ecosystem versions

Earlier releases before 4.0.17

Fixed in 4.0.17

155 explicitly affected versions

2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2, 2.8.0-RC3, 2.8.0-RC4, 2.8.0-alpha2, 2.8.0-alpha3, 2.8.0-beta, 2.8.0-beta2, 2.8.0-beta3, 2.8.1, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.8.15, 2.8.16, 2.8.17, 2.8.18, 2.8.19, 2.8.2, 2.8.20, 2.8.21, 2.8.22, 2.8.23, 2.8.24, 2.8.25, 2.8.26, 2.8.27, 2.8.28, 2.8.29, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.9.0, 2.9.0-alpha, 2.9.0-alpha2, 2.9.0-alpha3, 2.9.0-alpha4, 2.9.0-beta, 2.9.0-beta2, 2.9.0-rc, 2.9.0-rc2, 2.9.0-rc3, 2.9.0-rc4, 2.9.1, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 3.0.0, 3.0.0-RC, 3.0.0-RC.2, 3.0.0-alpha, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-beta, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC, 3.1.0-alpha, 3.1.0-alpha.2, 3.1.0-alpha.3, 3.1.0-beta, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0, 3.2.0-RC, 3.2.0-RC.2, 3.2.0-RC.4, 3.2.0-alpha, 3.2.0-beta, 3.2.0-beta.2, 3.2.1, 3.2.10, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 4.0.0, 4.0.0-RC, 4.0.0-RC.2, 4.0.0-RC.3, 4.0.0-RC.4, 4.0.0-RC.5, 4.0.0-alpha, 4.0.0-alpha.2, 4.0.0-alpha.3, 4.0.0-alpha.4, 4.0.0-beta, 4.0.0-beta.2, 4.0.1, 4.0.10, 4.0.11, 4.0.12, 4.0.13, 4.0.14, 4.0.15, 4.0.16, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.0.17"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.10.0-alpha",
    "2.8.0",
    "2.8.0-RC",
    "2.8.0-RC2",
    "2.8.0-RC3",
    "2.8.0-RC4",
    "2.8.0-alpha2",
    "2.8.0-alpha3",
    "2.8.0-beta",
    "2.8.0-beta2",
    "2.8.0-beta3",
    "2.8.1",
    "2.8.10",
    "2.8.11",
    "2.8.12",
    "2.8.13",
    "2.8.14",
    "2.8.15",
    "2.8.16",
    "2.8.17",
    "2.8.18",
    "2.8.19",
    "2.8.2",
    "2.8.20",
    "2.8.21",
    "2.8.22",
    "2.8.23",
    "2.8.24",
    "2.8.25",
    "2.8.26",
    "2.8.27",
    "2.8.28",
    "2.8.29",
    "2.8.3",
    "2.8.4",
    "2.8.5",
    "2.8.6",
    "2.8.7",
    "2.8.8",
    "2.8.9",
    "2.9.0",
    "2.9.0-alpha",
    "2.9.0-alpha2",
    "2.9.0-alpha3",
    "2.9.0-alpha4",
    "2.9.0-beta",
    "2.9.0-beta2",
    "2.9.0-rc",
    "2.9.0-rc2",
    "2.9.0-rc3",
    "2.9.0-rc4",
    "2.9.1",
    "2.9.10",
    "2.9.11",
    "2.9.12",
    "2.9.13",
    "2.9.2",
    "2.9.3",
    "2.9.4",
    "2.9.5",
    "2.9.6",
    "2.9.7",
    "2.9.8",
    "2.9.9",
    "3.0.0",
    "3.0.0-RC",
    "3.0.0-RC.2",
    "3.0.0-alpha",
    "3.0.0-alpha.2",
    "3.0.0-alpha.3",
    "3.0.0-alpha.4",
    "3.0.0-beta",
    "3.0.0-beta.2",
    "3.0.0-beta.3",
    "3.0.1",
    "3.0.10",
    "3.0.11",
    "3.0.12",
    "3.0.2",
    "3.0.3",
    "3.0.4",
    "3.0.5",
    "3.0.6",
    "3.0.7",
    "3.0.8",
    "3.0.9",
    "3.1.0",
    "3.1.0-RC",
    "3.1.0-alpha",
    "3.1.0-alpha.2",
    "3.1.0-alpha.3",
    "3.1.0-beta",
    "3.1.1",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.13",
    "3.1.14",
    "3.1.15",
    "3.1.16",
    "3.1.17",
    "3.1.18",
    "3.1.2",
    "3.1.3",
    "3.1.4",
    "3.1.5",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0-RC",
    "3.2.0-RC.2",
    "3.2.0-RC.4",
    "3.2.0-alpha",
    "3.2.0-beta",
    "3.2.0-beta.2",
    "3.2.1",
    "3.2.10",
    "3.2.2",
    "3.2.3",
    "3.2.4",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.8",
    "3.2.9",
    "4.0.0",
    "4.0.0-RC",
    "4.0.0-RC.2",
    "4.0.0-RC.3",
    "4.0.0-RC.4",
    "4.0.0-RC.5",
    "4.0.0-alpha",
    "4.0.0-alpha.2",
    "4.0.0-alpha.3",
    "4.0.0-alpha.4",
    "4.0.0-beta",
    "4.0.0-beta.2",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.13",
    "4.0.14",
    "4.0.15",
    "4.0.16",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9"
  ]
}

thorsten/phpmyfaq Packagist

Ecosystem versions

Earlier releases before 4.0.17

Fixed in 4.0.17

155 explicitly affected versions

2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2, 2.8.0-RC3, 2.8.0-RC4, 2.8.0-alpha2, 2.8.0-alpha3, 2.8.0-beta, 2.8.0-beta2, 2.8.0-beta3, 2.8.1, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.8.15, 2.8.16, 2.8.17, 2.8.18, 2.8.19, 2.8.2, 2.8.20, 2.8.21, 2.8.22, 2.8.23, 2.8.24, 2.8.25, 2.8.26, 2.8.27, 2.8.28, 2.8.29, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.9.0, 2.9.0-alpha, 2.9.0-alpha2, 2.9.0-alpha3, 2.9.0-alpha4, 2.9.0-beta, 2.9.0-beta2, 2.9.0-rc, 2.9.0-rc2, 2.9.0-rc3, 2.9.0-rc4, 2.9.1, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 3.0.0, 3.0.0-RC, 3.0.0-RC.2, 3.0.0-alpha, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-beta, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC, 3.1.0-alpha, 3.1.0-alpha.2, 3.1.0-alpha.3, 3.1.0-beta, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0, 3.2.0-RC, 3.2.0-RC.2, 3.2.0-RC.4, 3.2.0-alpha, 3.2.0-beta, 3.2.0-beta.2, 3.2.1, 3.2.10, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 4.0.0, 4.0.0-RC, 4.0.0-RC.2, 4.0.0-RC.3, 4.0.0-RC.4, 4.0.0-RC.5, 4.0.0-alpha, 4.0.0-alpha.2, 4.0.0-alpha.3, 4.0.0-alpha.4, 4.0.0-beta, 4.0.0-beta.2, 4.0.1, 4.0.10, 4.0.11, 4.0.12, 4.0.13, 4.0.14, 4.0.15, 4.0.16, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.0.17"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.10.0-alpha",
    "2.8.0",
    "2.8.0-RC",
    "2.8.0-RC2",
    "2.8.0-RC3",
    "2.8.0-RC4",
    "2.8.0-alpha2",
    "2.8.0-alpha3",
    "2.8.0-beta",
    "2.8.0-beta2",
    "2.8.0-beta3",
    "2.8.1",
    "2.8.10",
    "2.8.11",
    "2.8.12",
    "2.8.13",
    "2.8.14",
    "2.8.15",
    "2.8.16",
    "2.8.17",
    "2.8.18",
    "2.8.19",
    "2.8.2",
    "2.8.20",
    "2.8.21",
    "2.8.22",
    "2.8.23",
    "2.8.24",
    "2.8.25",
    "2.8.26",
    "2.8.27",
    "2.8.28",
    "2.8.29",
    "2.8.3",
    "2.8.4",
    "2.8.5",
    "2.8.6",
    "2.8.7",
    "2.8.8",
    "2.8.9",
    "2.9.0",
    "2.9.0-alpha",
    "2.9.0-alpha2",
    "2.9.0-alpha3",
    "2.9.0-alpha4",
    "2.9.0-beta",
    "2.9.0-beta2",
    "2.9.0-rc",
    "2.9.0-rc2",
    "2.9.0-rc3",
    "2.9.0-rc4",
    "2.9.1",
    "2.9.10",
    "2.9.11",
    "2.9.12",
    "2.9.13",
    "2.9.2",
    "2.9.3",
    "2.9.4",
    "2.9.5",
    "2.9.6",
    "2.9.7",
    "2.9.8",
    "2.9.9",
    "3.0.0",
    "3.0.0-RC",
    "3.0.0-RC.2",
    "3.0.0-alpha",
    "3.0.0-alpha.2",
    "3.0.0-alpha.3",
    "3.0.0-alpha.4",
    "3.0.0-beta",
    "3.0.0-beta.2",
    "3.0.0-beta.3",
    "3.0.1",
    "3.0.10",
    "3.0.11",
    "3.0.12",
    "3.0.2",
    "3.0.3",
    "3.0.4",
    "3.0.5",
    "3.0.6",
    "3.0.7",
    "3.0.8",
    "3.0.9",
    "3.1.0",
    "3.1.0-RC",
    "3.1.0-alpha",
    "3.1.0-alpha.2",
    "3.1.0-alpha.3",
    "3.1.0-beta",
    "3.1.1",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.13",
    "3.1.14",
    "3.1.15",
    "3.1.16",
    "3.1.17",
    "3.1.18",
    "3.1.2",
    "3.1.3",
    "3.1.4",
    "3.1.5",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0-RC",
    "3.2.0-RC.2",
    "3.2.0-RC.4",
    "3.2.0-alpha",
    "3.2.0-beta",
    "3.2.0-beta.2",
    "3.2.1",
    "3.2.10",
    "3.2.2",
    "3.2.3",
    "3.2.4",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.8",
    "3.2.9",
    "4.0.0",
    "4.0.0-RC",
    "4.0.0-RC.2",
    "4.0.0-RC.3",
    "4.0.0-RC.4",
    "4.0.0-RC.5",
    "4.0.0-alpha",
    "4.0.0-alpha.2",
    "4.0.0-alpha.3",
    "4.0.0-alpha.4",
    "4.0.0-beta",
    "4.0.0-beta.2",
    "4.0.1",
    "4.0.10",
    "4.0.11",
    "4.0.12",
    "4.0.13",
    "4.0.14",
    "4.0.15",
    "4.0.16",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.5",
    "4.0.6",
    "4.0.7",
    "4.0.8",
    "4.0.9"
  ]
}

Set up in your agent.

Investigate in your agent.

phpMyFAQ: Public API endpoints expose emails and invisible questions

The advisory, in context

Summary

Details

PoC

Impact

Affected packages

References