phpMyFAQ: Authorization bypass in visitor question API

Summary

phpMyFAQ before 4.1.10 contains an object-level authorization bypass in POST /api/faq/create. The endpoint accepts an arbitrary openQuestionID without ownership or permission checks, so an unauthenticated visitor who solves the CAPTCHA can change the category of any visitor question and forge 'answered' entries in the question history. If the administrator option records.enableDeleteQuestion is enabled, the same request permanently deletes the targeted question. The CNA rates the issue CVSS 4.0 8.7 (High); NVD status is Deferred.

Affected

• phpMyFAQ versions before 4.1.10 (CVE record: 0 to < 4.1.10)
• Severity depends on records.enableDeleteQuestion: disabled (default) gives High, enabled gives Critical (vendor advisory: CVSS 3.1 7.5 and 9.1)

Fixed in

• Upgrade to phpMyFAQ 4.1.10 or later (vendor advisory lists 4.1.10 as patched)
• The vendor's latest release at the time of research was 4.1.11; target 4.1.11 or later and check the vendor advisory for details

Workaround

• No vendor-documented workaround. Upgrading is the only documented fix.
• Interim measure (not from the vendor): block or restrict external access to /api/faq/create at the reverse proxy or WAF if public question submission is not needed.
• Confirm that records.enableDeleteQuestion is disabled.

Exploitation

• No exploitation reported; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable yes.
• No public proof of concept found in research; a private PoC cannot be ruled out.

Our recommendation

• Upgrade all phpMyFAQ instances to 4.1.11 or later, prioritising internet-facing installations.
• Until patched, restrict access to the question API or disable public question submission.
• Make sure records.enableDeleteQuestion is disabled.
• Check the database for unexpected category changes or missing visitor questions, and keep backups.
• Monitor web server logs for POST requests to /api/faq/create.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-9m55-g84r-x6v7 github.com
• VulnCheck advisory: phpMyFAQ before 4.1.10 authorization bypass www.vulncheck.com
• VulDB CVE-2026-116183 vuldb.com
• phpMyFAQ advisories www.phpmyfaq.de
• phpMyFAQ security policy github.com
• threatint CVE-2026-116183 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:17.