CVE-2026-111906 Details
Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.
A cross-site request forgery (CSRF) vulnerability has been identified in phpMyFAQ versions prior to 4.1.9 and 4.2.0-alpha prior to 4.2.0-beta. The vulnerability exists in the Elasticsearch and OpenSearch administration API endpoints, which fail to validate CSRF tokens for critical actions such as creating, dropping, and importing indexes. This lack of validation allows attackers to exploit users with 'CONFIGURATION_EDIT' permission, potentially leading to unauthorized deletion of search indexes, forced re-indexing, or resource exhaustion during large import operations.
To address this vulnerability, it is recommended to implement CSRF token validation for all state-changing actions in the Elasticsearch and OpenSearch administration API endpoints. This validation should occur before executing any actions on the Elasticsearch or OpenSearch services.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-cmvh-fpmf-8gfx | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-csrf-in-elasticsearch-opensearch-admin-api-index-operations | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 0, < 4.1.9 >= 4.2.0-alpha, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |