CVE-2026-111905
Deferred Deferred - Pending Action

Insecure Direct Object Reference in phpMyFAQ Exposes TOTP Secrets

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111905
EUVD
EUVD-2026-103315

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 3.2.0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in phpMyFAQ versions 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. It allows unauthorized access to any user's full data, including their live TOTP secret, via the GET /admin/api/user/data/{userId} endpoint without proper access controls.

Detection Guidance

To detect this vulnerability, check if your phpMyFAQ instance is running a vulnerable version (3.2.0 before 4.1.9 or 4.2.0-alpha before 4.2.0-beta). Test the endpoint GET /admin/api/user/data/{userId} by sending a request with a delegated admin account to see if it returns another user's TOTP secret. Use tools like curl to query the endpoint: curl -u username:password http://target/phpmyfaq/admin/api/user/data/1 where 1 is a user ID.

Impact Analysis

Delegated administrators with user-management rights can exploit this to read a SuperAdmin's TOTP secret and generate valid authentication codes, bypassing two-factor authentication. This could lead to unauthorized account access and potential data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, including authentication secrets like TOTP codes, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Unauthorized access to such data risks breaches of confidentiality and integrity, potentially resulting in regulatory penalties or legal consequences.

Mitigation Strategies

Immediately upgrade phpMyFAQ to version 4.1.9 or later. If upgrading is not possible, restrict access to the /admin/api/user/data/{userId} endpoint by implementing proper authorization checks. Remove SuperAdmin privileges from delegated administrators and ensure only SuperAdmins can access sensitive user data like TOTP secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart