Description
phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
thorsten phpMyFAQ
Default version status: unaffected
4.1.0 to ≤ 4.1.10affected
pkg:composer/thorsten/phpmyfaqReferences
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/phpmyfaq-mcp-search-visibility ↗
- https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Search.php#L137-L194 ↗
- https://github.com/thorsten/phpMyFAQ/blob/4.1.10/phpmyfaq/src/phpMyFAQ/Service/McpServer/FaqSearchToolExecutor.php#L56-L102 ↗
- https://github.com/thorsten/phpMyFAQ ↗
- https://www.vulncheck.com/advisories/phpmyfaq-through-4.1.10-missing-authorization-via-mcp-server-faq-search-tool ↗