CVE-2026-111906
Deferred Deferred - Pending Action

Cross-Site Request Forgery in phpMyFAQ Admin API

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATION_EDIT permission to a malicious page that triggers these actions, deleting search indexes, forcing re-indexing, or exhausting resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111906
EUVD
EUVD-2026-103314

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in phpMyFAQ versions before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. It affects the Elasticsearch and OpenSearch administration API endpoints, which do not validate CSRF tokens for create, drop, and import actions. Attackers can trick a user with CONFIGURATION_EDIT permission into visiting a malicious page, triggering unauthorized actions like deleting search indexes or forcing re-indexing.

Detection Guidance

To detect this vulnerability, check if your phpMyFAQ instance is running a vulnerable version (before 4.1.9 or 4.2.0-beta). Inspect network traffic for POST requests to /admin/api/elasticsearch/drop, /admin/api/elasticsearch/create, or /admin/api/elasticsearch/import without CSRF tokens. Review server logs for unauthorized index deletions or resource exhaustion events.

Impact Analysis

An attacker could delete search indexes, force re-indexing of the entire FAQ, or exhaust system resources by importing large files. This disrupts search functionality and may cause system downtime. Users with CONFIGURATION_EDIT permission are at risk if they visit a malicious site.

Compliance Impact

This CSRF vulnerability in phpMyFAQ could lead to unauthorized deletion of search indexes or resource exhaustion, potentially disrupting data availability and integrity. For GDPR, this may impact data access and processing rights. For HIPAA, it could affect the availability of protected health information systems.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.9 or later. Ensure all state-changing Elasticsearch/OpenSearch API actions require a valid CSRF token. Disable or restrict CONFIGURATION_EDIT permissions to trusted users only. Monitor for unusual index operations or resource spikes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111906. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart