CVE-2026-111888 Details
Description
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.
A vulnerability exists in phpMyFAQ versions 4.0.0 prior to 4.1.9, where an incorrect authorization check in the news update API allows delegated admins without the editnews permission to modify news items. The vulnerability arises because the PUT /admin/api/news/update endpoint verifies NEWS_DELETE permission instead of the required NEWS_EDIT. Exploiting this flaw, an attacker with addnews and delnews rights can access the update-news CSRF token from their cookie and alter any news item's header, body, author, link, and active status, with the changes reflected on the public front page and the public REST API.
Users can upgrade to phpMyFAQ version 4.1.9, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.0.0, < 4.1.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |