CVE-2026-108851— phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool
Quick assessment
Affected
thorsten phpMyFAQ
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
phpMyFAQ 4.1.10 及之前版本存在一个缺失的授权漏洞，该漏洞位于 MCP 服务器中的 工具。由于 方法从未应用用户或组权限检查，MCP 客户端可以读取受限的 FAQ 内容。连接到 phpmyfaq:mcp:server 的攻击者可以发出搜索查询，以检索对特定用户或组受限的活跃 FAQ 的完整问题与答案文本。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108851
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool
Source: CVE Program / CVE List V5
Vulnerability Description
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-108851
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108851
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108851 (2)
Vendor Advisories for CVE-2026-108851 (1)
Proof of Concept for CVE-2026-108851 (1)
Other References for CVE-2026-108851 (1)
IV. Related Vulnerabilities
Same product: phpMyFAQ
-
CVE-2026-109573
phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Sea -
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Al -
CVE-2026-56738
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped -
CVE-2026-56737
phpMyFAQ's two-factor authentication login bypasses the pass -
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity
Same vendor: thorsten
-
CVE-2026-109573
phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Sea -
CVE-2026-47132
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Al -
CVE-2026-56738
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped -
CVE-2026-56737
phpMyFAQ's two-factor authentication login bypasses the pass -
CVE-2026-56736
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity
Same weakness: CWE-862
-
CVE-2026-106176
FortiSIEM 7.5.0授权缺失漏洞 -
CVE-2026-110131
ThriveX-Server through 4.0 Missing Authorization via Article -
CVE-2026-110123
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization -
CVE-2026-110117
SmartAdmin through 3.30.0 Missing Authorization via AdminPro -
CVE-2026-110109
JetLinks Community through 2.10.0 Missing Authorization via
V. Comments for CVE-2026-108851
No comments yet