CVE-2026-111884 Details

A vulnerability exists in phpMyFAQ versions prior to 4.1.9 and 4.2.0-alpha prior to 4.2.0-beta, where the user control panel does not require the current password when changing an account email. Instead, it only verifies the session and CSRF token. This oversight allows an attacker with a hijacked session to change the email to their own and exploit the password reset feature to take over accounts without two-factor authentication, including superadmin accounts.

To address this vulnerability, phpMyFAQ should be updated to include a current password verification step when changing email addresses in the user control panel. Additionally, the previous email address should be notified of any changes, and password reset requests should be delayed if the email was recently changed.