CVE-2026-111908
Deferred Deferred - Pending Action

phpMyFAQ Broken Object-Level Authorization in FAQ Update

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111908
EUVD
EUVD-2026-103312

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 4.0.0
thorsten phpMyFAQ 4.2.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Broken Object-Level Authorization (BOLA) vulnerability in phpMyFAQ versions 4.0.0 through 4.1.8 and 4.2.0-alpha through 4.2.0-beta. It affects the PUT /api/v3.1/faq/update REST API endpoint, which only checks for a global edit_faq permission without verifying if the user has access to the specific FAQ they are trying to modify. This allows authenticated users with edit_faq permission to alter restricted FAQs they cannot view, bypass moderation, and change publication states.

Detection Guidance

To detect this vulnerability, monitor API logs for PUT requests to /api/v3.1/faq/update from users without proper object-level access. Check for unauthorized modifications to FAQ content or publication states by authenticated users with edit_faq permission.

Impact Analysis

An attacker with edit_faq permission could modify restricted FAQ content, bypass moderation controls, and change publication states without proper authorization. This could lead to unauthorized changes in sensitive information, misinformation being published, or restricted content being made public.

Compliance Impact

This vulnerability could lead to unauthorized modifications of sensitive data, potentially violating compliance requirements for data integrity and access controls in standards like GDPR and HIPAA. Unauthorized changes to restricted content may result in data breaches or improper disclosure of personal information.

Mitigation Strategies

Immediately restrict access to the PUT /api/v3.1/faq/update endpoint. Implement object-level authorization checks to verify user access to specific FAQs before allowing modifications. Temporarily disable the endpoint if no patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart