PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108851 thorsten CVE debrief

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool. This allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. The vulnerability exists due to a lack of permission checks, potentially leading to unauthorized access to restricted FAQs. Defenders should assess exposure and prioritize remediation, especially in environments where the MCP server faq_search tool is used.

Vendor
thorsten
Product
phpMyFAQ
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for phpMyFAQ installations, especially those using the MCP server faq_search tool, should assess exposure and prioritize remediation. This includes IT administrators, security teams, and operators who manage phpMyFAQ deployments. They should verify the usage of the MCP server faq_search tool, review current configurations, and implement necessary security controls to prevent unauthorized access to restricted FAQs.

Why it matters

Defenders should care about CVE-2026-108851 because it allows unauthorized access to restricted FAQs in phpMyFAQ installations using the MCP server faq_search tool. The vulnerability exists due to missing permission checks in Search::searchDatabase(). Defenders responsible for phpMyFAQ installations should assess exposure, prioritize remediation, and verify the usage of the MCP server faq_search tool.

  • Potential unauthorized access to restricted FAQs
  • Lack of permission checks in Search::searchDatabase()
  • MCP clients can issue search queries to retrieve restricted FAQ content
  • Verification of phpMyFAQ installations and MCP server faq_search tool usage is necessary

Technical summary

The vulnerability exists in the MCP server faq_search tool of phpMyFAQ through 4.1.10. The Search::searchDatabase() function does not apply user or group permission checks, allowing MCP clients to read restricted FAQs. This could lead to unauthorized access to sensitive information. Defenders should prioritize verifying and remediating this vulnerability in phpMyFAQ installations, especially where the MCP server faq_search tool is used, and consider implementing additional security measures to protect against potential exploitation.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in phpMyFAQ installations, especially where MCP server faq_search tool is used.

Recommended defensive actions

  • Verify phpMyFAQ installations for MCP server faq_search tool usage and assess exposure.
  • Restrict access to the faq_search tool to authorized users and groups.
  • Implement permission checks in Search::searchDatabase() to prevent unauthorized access.
  • Monitor for potential unauthorized access to restricted FAQs.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in phpMyFAQ's MCP server faq_search tool. Evidence is based on CVE Program records and supplemental source references. The vulnerability allows MCP clients to read restricted FAQs due to missing permission checks in Search::searchDatabase(). Defenders should verify phpMyFAQ installations and assess exposure to this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108851 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108851

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108851 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108851

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108851.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/thorsten/phpMyFAQ

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/phpmyfaq-through-4.1.10-missing-authorization-via-mcp-server-faq-search-tool

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.