High priorityDisclosed

Advisory · CVE-2026-111884

phpMyFAQ email change without current password enables account takeover

phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, does not require the current password when changing an account email, so an attacker with a hijacked session can point the account at their own mailbox and take it over through password reset, including superadmin accounts. CVSS 3.1 8.3.

Advisory published October 17, 2026Independent summary
Vendor
phpMyFAQ
Product
phpMyFAQ
Identifier / CWE
CVE-2026-111884
CWE-308
Action timing
Immediate
ELI5

Explain it like I’m five

Changing the recovery email asks only that you are logged in, never for the password, so one stolen session is enough to steal the whole account.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Session hijacked

    An attacker obtains a logged-in phpMyFAQ session for a target account.

  2. 02Email swapped

    Using only the session and CSRF token, the attacker changes the account email to a mailbox they control, with no current-password check.

  3. 03Reset and takeover

    The attacker runs the password-reset flow to the new mailbox and takes over the account, including superadmin accounts without 2FA.

What happened

The phpMyFAQ project disclosed CVE-2026-111884: the user control panel email change (UserController::updateData, api/user/data/update) checks only the session and CSRF token and does not require the current password (CWE-308). It affects versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

Per the vendor affected data in the NVD record, 4.1.9 and 4.2.0-beta are the first unaffected releases for their respective lines.

What to do

  1. Inventory phpMyFAQ instances, including staging, demo, and help-desk installs.
  2. Upgrade affected instances to 4.1.9 or later (or 4.2.0-beta or later on the 4.2 line) using the project release guidance.
  3. Restrict administrative and API access to trusted networks while remediation is underway.
  4. Hunt for account email changes followed by password resets, especially on administrative accounts, and sessions used from new locations.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Session theft is common; a missing step-up check is what turns it into permanent takeover. Upgrade and review email changes on privileged accounts before you trust them again.