CVE-2026-111887: Observable Response Discrepancy in thorsten phpMyFAQ

CVE-2026-111887 is an account enumeration vulnerability in phpMyFAQ affecting versions prior to 4.1.9 and 4.2.0-alpha prior to 4.2.0-beta. Unauthenticated attackers can submit guest comments with candidate user and email values to the comment creation endpoint. The application responds with a distinct HTTP 409 status code when a match is found, allowing attackers to confirm the existence of registered display names and associated emails. This observable response discrepancy enables attackers to gather valid user information for targeted phishing campaigns.

The vulnerability allows unauthenticated attackers to enumerate valid user display names and emails by exploiting the distinct HTTP 409 response. This information disclosure can be leveraged to conduct targeted phishing attacks against confirmed users. There is no indication of direct system compromise or privilege escalation from this vulnerability alone.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting or monitoring access to the comment creation endpoint to reduce enumeration risk.