Object-Level Authorization Bypass in phpMyFAQ Affects Unauthenticated Users

CVE-2026-116183

What is CVE-2026-116183?

An object-level authorization bypass vulnerability exists in phpMyFAQ versions prior to 4.1.10, enabling unauthenticated attackers to manipulate or remove visitor questions. By sending arbitrary openQuestionID values to the /api/faq/create endpoint, an attacker can exploit weaknesses in the system to modify question categories, create forged entries in the question history, or delete questions outright if the deletion feature is enabled. This flaw highlights the importance of stringent validation checks and the need for prompt security updates.

References