phpMyFAQ: Broken object-level authorization in FAQ update API
Summary
phpMyFAQ versions 4.0.0 to before 4.1.9 and 4.2.0-alpha to before 4.2.0-beta do not check object-level access in the PUT /api/v3.1/faq/update REST API endpoint. An authenticated user with the edit_faq permission can supply the ID of a restricted FAQ they cannot view and modify its content, bypass moderation and change its publication state. Exploitation requires a valid account with the edit_faq permission.
Affected
- phpMyFAQ 4.0.0 to before 4.1.9
- phpMyFAQ 4.2.0-alpha to before 4.2.0-beta
Fixed in
- phpMyFAQ 4.1.9
- phpMyFAQ 4.2.0-beta
- Later releases also include this fix. Check the vendor site for the current version.
Workaround
- No vendor-published workaround. Upgrading is the documented remedy.
- Until patched, limit the edit_faq permission to a small number of trusted editors.
- Review recent FAQ content and publication-state changes for unexpected edits.
Exploitation
- Not known to be exploited (CISA KEV: No, per the sources reviewed).
- CISA SSVC lists exploitation as PoC and automatable as no.
- Public proof of concept: unknown.
Our recommendation
- Upgrade phpMyFAQ to the latest 4.1.x or 4.2 beta release, not only to 4.1.9.
- Check which accounts hold the edit_faq permission and remove it where it is not needed.
- Review FAQ changes and publication-state changes for unexpected edits.
- Prioritise this if the instance is public-facing and has several editor accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-j3px-r7cr-r26r github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-111908 osv.dev
- VulDB entry 421620 vuldb.com
- Vulners CVE record vulners.com
- EUVD-2026-103312 vulners.com
- phpMyFAQ security advisories www.phpmyfaq.de
- GitHub issue on CISA KEV status github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:07.
Original description (NVD)
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.