How do I check whether I am affected by CVE-2026-111907?

- Check the installed version: `phpMyFAQ` version in the admin dashboard or `composer show phpmyfaq/phpmyfaq` if installed via Composer - Confirm whether the installed version falls in 4.0.0 through 4.1.8 - unknown whether the sources list other checks

What is the fix for CVE-2026-111907?

- Upgrade phpMyFAQ to `4.1.9` or later - unknown whether the sources list a workaround

Who is not affected by CVE-2026-111907?

Not affected if: no-admin-browsing-while-logged-in, version-4.1.9-or-later.

Live › vulnerability › CVE-2026-111907

Go to dashboard

high7.1Package

phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrations

phpMyFAQ 4.0.0 before 4.1.9 exposes a POST endpoint at /admin/api/update-database that runs database migrations without validating a CSRF token. A logged-in administrator with the CONFIGURATION_EDIT permission who visits a malicious page can be tricked into triggering migrations that may damage database integrity or availability.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.1

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: No.
Reachable from: internet.
Worst case: Forced database migrations may corrupt data or take the database offline.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Sites running phpMyFAQ from 4.0.0 up to but not including 4.1.9 are exposed, and the risk is greatest where administrators with CONFIGURATION_EDIT rights browse the web while logged into the admin area. Installations on a version before 4.0.0 or at 4.1.9 and later are not in the stated range.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-111907

Go to dashboard

high7.1Package

phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrations

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.1

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 17, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: No.
Reachable from: internet.
Worst case: Forced database migrations may corrupt data or take the database offline.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrations

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrations

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources