Incorrect Authorization Vulnerability in phpMyFAQ by phpMyFAQ Team
CVE-2026-111888

5.1MEDIUM

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111888?

An incorrect authorization vulnerability exists in phpMyFAQ versions 4.0.0 through 4.1.8, that allows admins without the necessary permissions to modify news items via the update API. This exploit arises from the API incorrectly validating user rights, permitting users with the 'addnews' and 'delnews' rights to manipulate news content by leveraging a CSRF token from their cookies. Attackers can change critical elements of news items displayed on the public front page, such as headers and content.

Affected Version(s)

phpMyFAQ 4.0.0 < 4.1.9

phpMyFAQ 4.1.9

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-befor...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

euriconicacio
.