CVE-2026-111884
Deferred Deferred - Pending Action

phpMyFAQ Session Hijacking via Email Change Without Password Verification

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111884
EUVD
EUVD-2026-103335

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-308 The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects phpMyFAQ versions before 4.1.9 and 4.2.0-beta. It allows an attacker with a hijacked session to change a user's email address without knowing the current password. The system only verifies the session and CSRF token. The attacker can then use the password-reset flow to take over the account, including superadmin accounts without 2FA.

Detection Guidance

Check phpMyFAQ versions before 4.1.9 or 4.2.0-beta for the vulnerability. Inspect user control panel email change requests to see if they require only session and CSRF token without current password. Review server logs for unauthorized email changes or password reset requests.

Impact Analysis

If you use phpMyFAQ versions before 4.1.9 or 4.2.0-beta, an attacker who hijacks your session could change your email address and reset your password. This could lead to loss of account control, unauthorized access to sensitive data, and potential takeover of admin accounts. Accounts without 2FA are fully compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized modifications, and non-compliance with access control and integrity requirements.

Mitigation Strategies

Upgrade phpMyFAQ to patched versions (4.1.9 or later, 4.2.0-beta or later). Implement additional verification steps for email changes requiring current password. Monitor accounts for suspicious email changes or password reset activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart