CVE-2026-47132

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.2.0-alpha

Description An authenticated SQL LIKE wildcard injection exists in the chat user search functionality. This issue allows any logged-in user to bypass the intended display-name search filter and enumerate active users, potentially disclosing internal user identities, staff names, or department names. While the application escapes SQL string syntax, it fails to escape % and characters, which the database interprets as active LIKE wildcards. The issue occurs at the '/api/chat/users' endpoint via the q parameter, specifically within the searchUsers() function.

Recommendations Update phpMyFAQ to version 4.2.0-alpha. As a temporary workaround, restrict access to the '/api/chat/users' endpoint or avoid using the q parameter in this endpoint until the update is applied.