Live › vulnerability › CVE-2026-111906
Go to dashboardphpMyFAQ's Elasticsearch and OpenSearch administration endpoints do not validate CSRF tokens for create, drop and import actions. A logged-in administrator with configuration edit rights who visits a malicious page can have their browser delete search indexes, force re-indexing or exhaust resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running phpMyFAQ before 4.1.9 or a 4.2 alpha build that use the Elasticsearch or OpenSearch search backend. The attack needs an administrator with CONFIGURATION_EDIT permission to be logged in and to open an attacker-controlled page. Installations without those search backends, or where no privileged user browses the web while logged in, have a lower practical exposure.
No product ranges from the sources yet.
phpMyFAQ admin dashboard or composer show phpmyfaq/phpmyfaq and look for a version below 4.1.9 or between 4.2.0-alpha and 4.2.0-beta4.1.9 or later on the 4.1 line4.2.0-beta or later if running the 4.2 alpha seriesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-111906")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.