Live › vulnerability › CVE-2026-111884
Go to dashboardphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta lets a user change their account email without entering the current password, checking only the session and CSRF token. An attacker holding a hijacked session can point the email at their own mailbox, then reset the password and take over accounts without 2FA, including superadmin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
4.1.9, or between 4.2.0-alpha and 4.2.0-beta, you are exposed4.1.9 or later (or 4.2.0-beta or later for the 4.2 line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.
This page as .md · .json · in your agent: get_signal("CVE-2026-111884")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.