Cross-Site Request Forgery Vulnerability in phpMyFAQ Product by phpMyFAQ
CVE-2026-111906

7.1HIGH

Key Information:

Vendor

Thorsten

Status
pHPMyFAQ
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111906?

A cross-site request forgery (CSRF) vulnerability exists in phpMyFAQ versions prior to 4.1.9 and 4.2.0-alpha before 4.2.0-beta. The issue lies within the Elasticsearch and OpenSearch administration API endpoints, which fail to properly validate CSRF tokens for critical actions such as creating, dropping, and importing. This oversight could allow attackers to deceive users with CONFIGURATION_EDIT permissions into visiting malicious pages, triggering destructive actions that might lead to deletion of search indexes, forced re-indexing operations, or resource exhaustion.

Affected Version(s)

phpMyFAQ 0 < 4.1.9

phpMyFAQ 4.2.0-alpha < 4.2.0-beta

phpMyFAQ 4.1.9

References

https://github.com/thorsten/phpMyFAQ/security/advisories/...
vendor-advisory
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1....
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sultan0f1
.