CVE-2026-47132: phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

August 12, 2026 (updated September 24, 2026)

An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and _, which remain active LIKE wildcards.

References

github.com/advisories/GHSA-6pvm-2vjj-rx4w
github.com/thorsten/phpMyFAQ/commit/bd4b08b012234ccfcff07bfe6518062475b29e0a
github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w
nvd.nist.gov/vuln/detail/CVE-2026-47132

Code Behaviors & Features

Detect and mitigate CVE-2026-47132 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →