CVE-2026-46366 is an incorrect authorization vulnerability in phpMyFAQ prior to version 4.1.2. The getIdFromSolutionId() method lacks proper permission filtering, enabling unauthenticated attackers to enumerate and read titles of FAQ entries that are meant to be restricted to specific users or groups. Attackers can exploit this by sequentially accessing the /solution_id_{id}.html endpoint, causing leakage of sensitive metadata through HTTP redirect Location headers and canonical link tags. This vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to its network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

The vulnerability allows unauthenticated attackers to disclose sensitive information by enumerating restricted FAQ entries and reading their titles. This compromises confidentiality of restricted content metadata but does not affect integrity or availability of the system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects phpMyFAQ versions before 4.1.2, upgrading to version 4.1.2 or later is likely the intended remediation. Until an official fix is confirmed, restrict access to the affected endpoints and monitor for suspicious activity related to sequential solution ID enumeration.