CVE-2026-111887
Last modified
CVE-2026-111887 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing..
Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to confirm registered display names and emails via a distinct HTTP 409 response. Attackers can submit guest comments to the comment create endpoint with candidate user and mail values to link names to emails for targeted phishing.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111887?
How severe is CVE-2026-111887?
How do I fix CVE-2026-111887?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111880FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out…7.4
- CVE-2026-111881FreeRDP from 3.14.1 before 3.32.0 contains an integer underf…7.6
- CVE-2026-111882phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2…8.1
- CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does…8.3
- CVE-2026-111885phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missi…5.5
- CVE-2026-111886phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-fo…6.5
- CVE-2026-111888phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect autho…2.7
- CVE-2026-111889phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.…4.3
- CVE-2026-11189Insufficient validation of untrusted input in DevTools in Go…6.5
- CVE-2026-111890phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a pri…5.5
- CVE-2026-111891phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a pri…5.5
- CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate …6.5
Are you affected by CVE-2026-111887?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST