{"id":"CVE-2026-111906","kind":"vulnerability","aliases":["CVE-2026-111906"],"related":[],"title":"phpMyFAQ: missing CSRF checks let attackers drop or rebuild search indexes","description":"phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.","summary":"phpMyFAQ's Elasticsearch and OpenSearch administration endpoints do not validate CSRF tokens for create, drop and import actions. A logged-in administrator with configuration edit rights who visits a malicious page can have their browser delete search indexes, force re-indexing or exhaust resources.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elasticsearch","opensearch","package","php","phpmyfaq","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version with `phpMyFAQ` admin dashboard or `composer show phpmyfaq/phpmyfaq` and look for a version below `4.1.9` or between `4.2.0-alpha` and `4.2.0-beta`\n- Confirm whether Elasticsearch or OpenSearch search is enabled in the phpMyFAQ configuration","fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line\n- Upgrade to `4.2.0-beta` or later if running the 4.2 alpha series","status":"open","published_at":"2026-10-17T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:19+00:00","updated_at":"2026-10-25T03:36:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:36:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line\n- Upgrade to `4.2.0-beta` or later if running the 4.2 alpha series","reach":"internet","title":"phpMyFAQ: missing CSRF checks let attackers drop or rebuild search indexes","impact":"medium","summary":"phpMyFAQ's Elasticsearch and OpenSearch administration endpoints do not validate CSRF tokens for create, drop and import actions. A logged-in administrator with configuration edit rights who visits a malicious page can have their browser delete search indexes, force re-indexing or exhaust resources.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted","elasticsearch","opensearch"],"confidence":0.8,"needs_auth":"yes","worst_case":"Search indexes deleted and resources exhausted via forged admin requests","analyst_note":"","how_to_check":"- Check the installed version with `phpMyFAQ` admin dashboard or `composer show phpmyfaq/phpmyfaq` and look for a version below `4.1.9` or between `4.2.0-alpha` and `4.2.0-beta`\n- Confirm whether Elasticsearch or OpenSearch search is enabled in the phpMyFAQ configuration","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running phpMyFAQ before 4.1.9 or a 4.2 alpha build that use the Elasticsearch or OpenSearch search backend. The attack needs an administrator with CONFIGURATION_EDIT permission to be logged in and to open an attacker-controlled page. Installations without those search backends, or where no privileged user browses the web while logged in, have a lower practical exposure.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000673,"input_tokens":3399,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111906':14A,17A '-2026':13A,16A '4.1.9':74C '4.2.0':76C,79C 'action':43B,110C,127C 'administr':31B,48B,94C 'alpha':77C 'api':95C 'attack':6A,111C 'beta':80C 'browser':61B 'check':4A 'configur':50B,117C 'contain':81C 'creat':39B,106C 'cross':84C 'cross-sit':83C 'csrf':3A,36B,102C 'cve':12A,15A 'delet':62B,128C 'drop':7A,40B,107C 'edit':51B,118C 'elasticsearch':18B,28B,91C 'endpoint':32B,96C 'exhaust':70B,136C 'forc':65B,131C 'forgeri':87C 'host':25B 'import':42B,109C 'index':11A,64B,68B,130C,134C 'let':5A 'log':46B 'logged-in':45B 'lure':113C 'malici':56B,122C 'miss':2A 'opensearch':19B,30B,93C 'packag':20B 'page':57B,123C 'permiss':119C 'php':21B 'phpmyfaq':1A,22B,26B,72C 're':67B,133C 're-index':66B,132C 'rebuild':9A 'request':86C 'resourc':71B,137C 'right':52B 'search':10A,63B,129C 'self':24B 'self-host':23B 'site':85C 'token':37B,103C 'trigger':125C 'user':115C 'valid':35B,100C 'visit':54B 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ before 4.1.9 or a 4.2 alpha build that use the Elasticsearch or OpenSearch search backend. The attack needs an administrator with CONFIGURATION_EDIT permission to be logged in and to open an attacker-controlled page. Installations without those search backends, or where no privileged user browses the web while logged in, have a lower practical exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111906","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111906","severity":null,"published_at":"2026-10-17T19:16:32+00:00","modified_at":"2026-10-19T15:16:55+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}