Live › vulnerability › CVE-2026-111888
Go to dashboardphpMyFAQ from 4.0.0 before 4.1.9 checks the NEWS_DELETE permission instead of NEWS_EDIT on the news update endpoint. A delegated admin holding only addnews and delnews can rewrite any news item's header, body, author, link and active flag, which appears on the public front page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ 4.0.0 through 4.1.8 that use delegated admin accounts with the addnews and delnews rights but not editnews. Single-admin installs and sites that do not delegate news rights have no path to this flaw.
No product ranges from the sources yet.
composer show phpmyfaq/phpmyfaq if installed by Composer4.1.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.
This page as .md · .json · in your agent: get_signal("CVE-2026-111888")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.