Live › vulnerability › CVE-2026-116183
Go to dashboardphpMyFAQ before 4.1.10 fails to check object ownership when handling POST /api/faq/create, so an arbitrary openQuestionID can be supplied. An unauthenticated attacker who solves the CAPTCHA can rewrite question categories, forge answered entries, or delete questions when enableDeleteQuestion is on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any public phpMyFAQ instance below 4.1.10 that accepts visitor questions through the FAQ create API is exposed, since the flaw requires no login, only a CAPTCHA solve. Instances with the question feature turned off or behind authentication carry less exposure. Deletion is only possible where enableDeleteQuestion is enabled.
No product ranges from the sources yet.
4.1.10records.enableDeleteQuestion in the phpMyFAQ configuration to see whether deletion is enabled4.1.10 or laterrecords.enableDeleteQuestionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in faqquestion_history, or permanently delete questions when records.enableDeleteQuestion is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-116183")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.