CVE-2026-111889
Deferred Deferred - Pending Action

phpMyFAQ Missing Authorization in Admin Dashboard Exposes Sensitive Data

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111889
EUVD
EUVD-2026-103330

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 4.1.0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a missing authorization vulnerability in phpMyFAQ versions 4.1.0 to 4.1.9 and 4.2.0-alpha before 4.2.0-beta. It allows authenticated users without admin rights to access restricted admin dashboard data by requesting /admin/index.php/. Attackers with any active account can view unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.

Detection Guidance

Check if unauthorized users can access /admin/index.php/ by attempting to visit the URL while logged in with a non-admin account. Monitor server logs for requests to this endpoint from non-admin users. Use tools like curl to test access: curl -u username:password http://target/phpmyfaq/admin/index.php/

Verify if unpublished FAQs, user identities, or site statistics are exposed by inspecting responses for sensitive metadata. Compare responses between admin and non-admin accounts for discrepancies.

Impact Analysis

Unauthorized users can access sensitive metadata like unpublished FAQ content, admin edit links, recent user account details (IDs, names, join times), and site statistics. This exposes internal information but does not allow draft content access or super admin privileges. The impact is primarily information disclosure.

Compliance Impact

This vulnerability allows unauthorized access to restricted data such as unpublished FAQ questions, user identities, and site statistics. Such exposure of personal or sensitive information could violate GDPR's data protection principles or HIPAA's privacy rules if user data is involved.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.9 or 4.2.0-beta or later to apply the patch that adds proper permission checks to the admin dashboard.

Temporarily restrict access to the admin dashboard by modifying server rules to allow only admin IPs or implement additional authentication layers until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111889. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart