CVE-2026-111907
Deferred Deferred - Pending Action

Cross-Site Request Forgery in phpMyFAQ Admin API

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111907
EUVD
EUVD-2026-103313

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thorsten phpMyFAQ 4.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in phpMyFAQ versions 4.0.0 to 4.1.8. It allows attackers to trick authenticated users with CONFIGURATION_EDIT permission into submitting a malicious request to the /admin/api/update-database endpoint. The endpoint executes database migrations without validating a CSRF token, potentially compromising database integrity or availability.

Detection Guidance

Check phpMyFAQ logs for unauthorized POST requests to /admin/api/update-database. Monitor network traffic for suspicious admin API calls without CSRF tokens. Review database migration logs for unexpected changes.

Impact Analysis

An attacker could exploit this to perform unauthorized database migrations, leading to data corruption, loss of availability, or unintended changes. This could disrupt phpMyFAQ operations or corrupt stored data if the victim has sufficient permissions.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially allowing unauthorized database modifications. Unvalidated CSRF requests may lead to unauthorized changes in database structure or content, which could compromise data integrity or availability. Such unauthorized access or alterations may violate GDPR's data integrity principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.9 or later. Ensure all sensitive endpoints require CSRF tokens. Restrict CONFIGURATION_EDIT permissions to trusted users only. Review database integrity after updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart