{"id":"CVE-2026-111907","kind":"vulnerability","aliases":["CVE-2026-111907"],"related":[],"title":"phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrations","description":"phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.","summary":"phpMyFAQ 4.0.0 before 4.1.9 exposes a POST endpoint at /admin/api/update-database that runs database migrations without validating a CSRF token. A logged-in administrator with the CONFIGURATION_EDIT permission who visits a malicious page can be tricked into triggering migrations that may damage database integrity or availability.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["no-admin-browsing-while-logged-in","version-4.1.9-or-later"],"how_to_check":"- Check the installed version: `phpMyFAQ` version in the admin dashboard or `composer show phpmyfaq/phpmyfaq` if installed via Composer\n- Confirm whether the installed version falls in 4.0.0 through 4.1.8\n- unknown whether the sources list other checks","fix":"- Upgrade phpMyFAQ to `4.1.9` or later\n- unknown whether the sources list a workaround","status":"open","published_at":"2026-10-17T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:18+00:00","updated_at":"2026-10-25T03:36:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later\n- unknown whether the sources list a workaround","reach":"internet","title":"phpMyFAQ: admin database update endpoint lacks CSRF checks, enabling forced migrations","impact":"medium","summary":"phpMyFAQ 4.0.0 before 4.1.9 exposes a POST endpoint at /admin/api/update-database that runs database migrations without validating a CSRF token. A logged-in administrator with the CONFIGURATION_EDIT permission who visits a malicious page can be tricked into triggering migrations that may damage database integrity or availability.","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Forced database migrations may corrupt data or take the database offline.","analyst_note":"","how_to_check":"- Check the installed version: `phpMyFAQ` version in the admin dashboard or `composer show phpmyfaq/phpmyfaq` if installed via Composer\n- Confirm whether the installed version falls in 4.0.0 through 4.1.8\n- unknown whether the sources list other checks","needs_analyst":false,"not_affected_if":["version-4.1.9-or-later","no-admin-browsing-while-logged-in"],"who_is_affected":"Sites running phpMyFAQ from 4.0.0 up to but not including 4.1.9 are exposed, and the risk is greatest where administrators with CONFIGURATION_EDIT rights browse the web while logged into the admin area. Installations on a version before 4.0.0 or at 4.1.9 and later are not in the stated range.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3359,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111907':14A,17A '-2026':13A,16A '/admin/api/update-database':33B,86C '4.0.0':25B,72C '4.1.9':27B,74C 'admin':2A 'administr':47B 'attack':97C 'avail':70B,126C 'check':8A 'configur':50B,107C 'contain':75C 'craft':113C 'cross':78C,115C 'cross-sit':77C,114C 'csrf':7A,41B,95C 'cve':12A,15A 'damag':66B 'databas':3A,36B,67B,90C,123C 'edit':51B,108C 'enabl':9A 'endpoint':5A,31B,87C 'execut':89C 'expos':28B 'forc':10A 'forgeri':81C 'host':23B 'impact':122C 'integr':68B,124C 'lack':6A 'log':45B,102C 'logged-in':44B,101C 'lure':99C 'malici':56B 'may':65B,121C 'migrat':11A,37B,63B,91C,119C 'packag':18B 'page':57B 'permiss':52B,109C 'php':19B 'phpmyfaq':1A,20B,24B,71C 'post':30B,85C 'request':80C,117C 'run':35B 'self':22B 'self-host':21B 'site':79C,116C 'submit':111C 'token':42B,96C 'trick':60B 'trigger':62B,118C 'updat':4A 'user':104C 'valid':39B,93C 'visit':54B 'vulner':82C 'without':38B,92C","nicknames":[],"mitigations":[],"who_affected":"Sites running phpMyFAQ from 4.0.0 up to but not including 4.1.9 are exposed, and the risk is greatest where administrators with CONFIGURATION_EDIT rights browse the web while logged into the admin area. Installations on a version before 4.0.0 or at 4.1.9 and later are not in the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111907","severity":null,"published_at":"2026-10-17T19:16:32+00:00","modified_at":"2026-10-19T17:17:05+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}