{"id":"CVE-2026-111905","kind":"vulnerability","aliases":["CVE-2026-111905"],"related":[],"title":"phpMyFAQ: admin user API leaks any user's TOTP secret","description":"phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.","summary":"A flaw in the admin user-data endpoint returns any user's full record, including the live TOTP two-factor secret, without checking the caller's rights. A delegated administrator with user-management rights can read a SuperAdmin's secret and generate valid codes to bypass two-factor authentication.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed version with `composer show phpmyfaq/phpmyfaq` or the version shown in the admin panel; affected versions are 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.\n- Review who holds user-management rights in the admin panel; unknown whether the sources list exact log or file checks.","fix":"- Upgrade phpMyFAQ to `4.1.9` or later (or to `4.2.0-beta` or later on the 4.2 line).\n- Rotate TOTP secrets for SuperAdmin accounts after upgrading if delegated admins had user-management rights before the fix; unknown whether the sources give a specific rotation procedure.","status":"open","published_at":"2026-10-17T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:38:24+00:00","updated_at":"2026-10-25T03:38:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:38:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later (or to `4.2.0-beta` or later on the 4.2 line).\n- Rotate TOTP secrets for SuperAdmin accounts after upgrading if delegated admins had user-management rights before the fix; unknown whether the sources give a specific rotation procedure.","reach":"internet","title":"phpMyFAQ: admin user API leaks any user's TOTP secret","impact":"high","summary":"A flaw in the admin user-data endpoint returns any user's full record, including the live TOTP two-factor secret, without checking the caller's rights. A delegated administrator with user-management rights can read a SuperAdmin's secret and generate valid codes to bypass two-factor authentication.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads SuperAdmin TOTP secret and bypasses two-factor login","analyst_note":"","how_to_check":"- Check the installed version with `composer show phpmyfaq/phpmyfaq` or the version shown in the admin panel; affected versions are 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.\n- Review who holds user-management rights in the admin panel; unknown whether the sources list exact log or file checks.","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Installations running phpMyFAQ 3.2.0 through 4.1.x before 4.1.9, or 4.2.0-alpha builds before 4.2.0-beta, are exposed. The risk is greatest where delegated administrators hold user-management rights alongside SuperAdmin accounts that use two-factor authentication.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":3402,"output_tokens":661,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111905':13A,16A '-2026':12A,15A '/admin/api/user/data':95C '3.2.0':77C '4.1.9':79C '4.2.0':81C,84C 'admin':2A,27B 'administr':54B,119C 'alpha':82C 'api':4A 'authent':75B,141C 'beta':85C 'bypass':71B,137C 'caller':49B 'check':47B,117C 'code':69B,135C 'contain':86C 'cve':11A,14A 'data':30B 'deleg':53B,118C 'direct':89C 'endpoint':31B 'factor':44B,74B,140C 'faquserdata':103C 'flaw':24B 'full':36B,102C 'generat':67B,133C 'get':94C 'host':22B 'includ':38B,105C 'insecur':88C 'leak':5A 'live':40B,107C 'manag':58B,123C 'object':90C 'packag':17B 'php':18B 'phpmyfaq':1A,19B,76C 'protect':115C 'protected-target':114C 'read':61B,126C 'record':37B 'refer':91C 'return':32B,98C 'right':51B,59B,124C 'row':104C 'secret':10A,45B,65B,109C,131C 'self':21B 'self-host':20B 'superadmin':63B,112C,128C 'target':116C 'totp':9A,41B,108C,130C 'two':43B,73B,139C 'two-factor':42B,72B,138C 'user':3A,7A,29B,34B,57B,100C,122C 'user-data':28B 'user-manag':56B,121C 'userid':96C 'valid':68B,134C 'vulner':92C 'without':46B,110C","nicknames":[],"mitigations":[],"who_affected":"Installations running phpMyFAQ 3.2.0 through 4.1.x before 4.1.9, or 4.2.0-alpha builds before 4.2.0-beta, are exposed. The risk is greatest where delegated administrators hold user-management rights alongside SuperAdmin accounts that use two-factor authentication.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111905","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111905","severity":null,"published_at":"2026-10-17T19:16:32+00:00","modified_at":"2026-10-21T22:16:47+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}