High priorityDisclosed

Advisory · CVE-2026-111908

phpMyFAQ FAQ update endpoint lets editors modify restricted FAQs

phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, checks only the global edit_faq permission on the FAQ update endpoint, so authenticated editors can modify restricted FAQs they cannot view, bypass moderation, and change publication state. CVSS 3.1 8.3.

Advisory published October 17, 2026Independent summary
Vendor
phpMyFAQ
Product
phpMyFAQ
Identifier / CWE
CVE-2026-111908
CWE-639
Action timing
Immediate
ELI5

Explain it like I’m five

The edit door checks that you are an editor somewhere, not that this particular FAQ is yours to edit, so any editor can rewrite any entry by guessing its number.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Editor signs in

    An authenticated user with the global edit_faq permission targets the FAQ update endpoint.

  2. 02Restricted ID supplied

    The attacker supplies the ID of a restricted FAQ they cannot view.

  3. 03Content changed

    The endpoint modifies the FAQ, bypassing moderation and changing its publication state.

What happened

The phpMyFAQ project disclosed CVE-2026-111908: a broken object-level authorization flaw (CWE-639) in PUT /api/v3.1/faq/update, which checks only the global edit_faq permission and does not verify access to the target FAQ. It affects versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

Per the vendor affected data in the NVD record, 4.1.9 and 4.2.0-beta are the first unaffected releases for their respective lines.

What to do

  1. Inventory phpMyFAQ instances, including staging, demo, and help-desk installs.
  2. Upgrade affected instances to 4.1.9 or later (or 4.2.0-beta or later on the 4.2 line) using the project release guidance.
  3. Restrict administrative and API access to trusted networks while remediation is underway.
  4. Hunt for FAQ edits by editors outside the category that owns the entry, and publication state changes outside normal moderation.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Category restrictions are how multi-team knowledge bases stay trustworthy. Until patched, treat unexpected edits to restricted FAQs as a content integrity incident, not a nuisance.