Live › vulnerability › CVE-2026-111908
Go to dashboardphpMyFAQ versions 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta check only the global edit permission on the FAQ update API, not access to the specific FAQ. A logged-in user with edit rights can change restricted FAQs, bypass moderation and alter publication state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Upgrade phpMyFAQ to 4.1.9 or later, or to 4.2.0-beta or later if on the 4.2 line.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.
This page as .md · .json · in your agent: get_signal("CVE-2026-111908")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.