CVE-2026-85589: Missing Authorization in thorsten phpMyFAQ

CVE-2026-85589 describes a missing authorization vulnerability in phpMyFAQ prior to version 4.2.0-alpha.2. The admin dashboard API endpoints 'searches' and 'content-health' require authentication but lack proper permission checks. This flaw permits any authenticated user, regardless of their assigned privileges, to access sensitive site-wide search statistics and content-health counters, potentially exposing internal metrics that should be restricted to privileged users.

The vulnerability allows any authenticated user to read site-wide search statistics and content-health counters without proper authorization. While this does not permit modification or administrative control, it exposes potentially sensitive operational data to unauthorized users. The CVSS 4.0 score of 5.3 reflects a medium severity impact due to information disclosure without privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints by limiting authentication to trusted users only or implementing additional access controls at the application or network level.