CVE-2026-111888
Deferred Deferred - Pending Action

Incorrect Authorization in phpMyFAQ Allows News Modification

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111888
EUVD
EUVD-2026-103331

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect authorization flaw in phpMyFAQ versions 4.0.0 to 4.1.8. It allows delegated admins without NEWS_EDIT permission to modify news via the PUT /admin/api/news/update endpoint, which incorrectly checks for NEWS_DELETE instead. Attackers with addnews and delnews permissions can exploit this to change news headers, bodies, authors, links, and active status on public pages.

Detection Guidance

Check phpMyFAQ logs for unusual PUT requests to /admin/api/news/update from non-admin accounts. Inspect news content on public pages for unauthorized changes. Review user permissions for delegated admins with addnews and delnews but lacking editnews rights.

Impact Analysis

If you use phpMyFAQ versions 4.0.0 to 4.1.8, an attacker with delegated admin access but lacking NEWS_EDIT could deface your public news content. They could alter news items to display false information, change authors, or link to malicious sites. This could damage your organization's reputation or mislead visitors.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modification of public-facing content, potentially violating integrity requirements in GDPR or HIPAA. If news content is used for critical communications, unauthorized changes could lead to misinformation or data integrity issues, though direct compliance impacts depend on specific use cases.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.9 or later. Remove NEWS_DELETE permission from delegated admins without NEWS_EDIT rights. Monitor news content for unauthorized modifications. Restrict access to the /admin/api/news/update endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart