phpMyFAQ before version 4.1.2 contains an authorization bypass vulnerability in the getIdFromSolutionId() method. This method lacks permission filtering, enabling unauthenticated attackers to enumerate FAQ entries that should be restricted. By sequentially requesting the /solution_id_{id}.html endpoint with different IDs, attackers can obtain titles of FAQs intended for specific users or groups. The vulnerability leaks sensitive metadata via HTTP redirect Location headers and canonical link elements in the page. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with no privileges or user interaction required, and a high impact on confidentiality. No patch or official remediation level has been disclosed.

The vulnerability allows unauthorized disclosure of restricted FAQ titles and metadata, potentially exposing sensitive information intended only for authorized users or groups. While it does not affect integrity or availability, the confidentiality breach could aid attackers in gathering intelligence about protected content. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoints via network controls or web application firewalls to prevent unauthorized enumeration. Monitor vendor communications for updates regarding patches or official mitigations.