{"id":"CVE-2026-111888","kind":"vulnerability","aliases":["CVE-2026-111888"],"related":[],"title":"phpMyFAQ: delegated admins can rewrite news without the edit right","description":"phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.","summary":"phpMyFAQ from 4.0.0 before 4.1.9 checks the NEWS_DELETE permission instead of NEWS_EDIT on the news update endpoint. A delegated admin holding only addnews and delnews can rewrite any news item's header, body, author, link and active flag, which appears on the public front page.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["no-delegated-news-rights","single-admin","version-4.1.9-or-later"],"how_to_check":"- Check the installed phpMyFAQ version in the admin panel or `composer show phpmyfaq/phpmyfaq` if installed by Composer\n- Review which delegated admin accounts hold the addnews and delnews rights without editnews","fix":"- Upgrade phpMyFAQ to `4.1.9` or later\n- Until upgraded, remove the addnews or delnews right from delegated admins who do not need it","status":"open","published_at":"2026-10-17T19:16:30+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:29:11+00:00","updated_at":"2026-10-25T04:29:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:29:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later\n- Until upgraded, remove the addnews or delnews right from delegated admins who do not need it","reach":"internet","title":"phpMyFAQ: delegated admins can rewrite news without the edit right","impact":"medium","summary":"phpMyFAQ from 4.0.0 before 4.1.9 checks the NEWS_DELETE permission instead of NEWS_EDIT on the news update endpoint. A delegated admin holding only addnews and delnews can rewrite any news item's header, body, author, link and active flag, which appears on the public front page.","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker rewrites public news items shown on the front page","analyst_note":"","how_to_check":"- Check the installed phpMyFAQ version in the admin panel or `composer show phpmyfaq/phpmyfaq` if installed by Composer\n- Review which delegated admin accounts hold the addnews and delnews rights without editnews","needs_analyst":false,"not_affected_if":["single-admin","no-delegated-news-rights","version-4.1.9-or-later"],"who_is_affected":"Sites running phpMyFAQ 4.0.0 through 4.1.8 that use delegated admin accounts with the addnews and delnews rights but not editnews. Single-admin installs and sites that do not delegate news rights have no path to this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3386,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111888':13A,16A '-2026':12A,15A '/admin/api/news/update':94C '4.0.0':25B,72C '4.1.9':27B,74C 'activ':61B,131C 'addnew':47B,105C 'admin':3A,44B,83C 'allow':81C 'appear':64B 'attack':103C 'author':58B,78C,128C 'bodi':57B,127C 'call':92C 'check':28B,96C 'contain':75C 'cooki':119C 'csrf':114C 'cve':11A,14A 'deleg':2A,43B,82C 'delet':31B,98C 'delnew':49B,107C 'edit':9A,36B,102C 'editnew':86C 'endpoint':41B 'flag':62B,132C 'front':68B,137C 'header':56B,126C 'hold':45B,104C 'host':22B 'incorrect':77C 'instead':33B,99C 'item':54B,124C 'lack':84C 'link':59B,129C 'modifi':89C 'news':6A,30B,35B,39B,53B,90C,97C,101C,113C,123C 'packag':17B 'page':69B,138C 'permiss':32B 'php':18B 'phpmyfaq':1A,19B,23B,70C 'public':67B,136C 'put':93C 'read':109C 'rewrit':5A,51B,121C 'right':10A,87C 'self':21B 'self-host':20B 'shown':133C 'token':115C 'updat':40B,112C 'update-new':111C 'vulner':79C 'without':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ 4.0.0 through 4.1.8 that use delegated admin accounts with the addnews and delnews rights but not editnews. Single-admin installs and sites that do not delegate news rights have no path to this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111888","severity":null,"published_at":"2026-10-17T19:16:30+00:00","modified_at":"2026-10-18T12:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}