CVE-2026-111908 Details
Description
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
A broken object-level authorization vulnerability has been identified in phpMyFAQ versions 4.0.0 prior to 4.1.9 and 4.2.0-alpha prior to 4.2.0-beta. The vulnerability exists in the PUT /api/v3.1/faq/update endpoint, where the authorization check only verifies the global edit_faq permission without ensuring access to the specific FAQ being modified. This allows authenticated users with edit_faq permission to alter the content of restricted FAQs they cannot view, bypass moderation, and change the publication status of those FAQs.
Before updating a FAQ, the application should verify access through the existing permission-aware retrieval logic and deny the operation if the user cannot access the targeted FAQ. The update process should also maintain the current ACL and restriction states, unless a specifically authorized action is taken to change them.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j3px-r7cr-r26r | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-bola-in-faq-update-via-rest-api | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.0.0, < 4.1.9 (semver) >= 4.2.0-alpha, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |