Jwngo

**Name of the Vulnerable Software and Affected Versions** phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta **Description** An information disclosure issue exists where unauthenticated attackers can read hidden open questions. This occurs due to an inverted `api.onlyPublicQuestions` check within the `OpenQuestionController` function. By sending GET requests to the '/api/v4.0/open-questions' endpoint, attackers can retrieve internal or moderation questions and the usernames associated with them. **Recommendations** Update phpMyFAQ to version 4.2.0-beta or later.