SB20261110336 - Multiple vulnerabilities in phpMyFAQ

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261110336

SB20261110336 - Multiple vulnerabilities in phpMyFAQ

Published: November 10, 2026

Security Bulletin ID SB20261110336
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 10% Medium 50% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Improper Restriction of Excessive Authentication Attempts (CVE-ID: N/A)

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to permanently disable two-factor authentication on a compromised account.

The vulnerability exists due to improper restriction of excessive authentication attempts in phpMyFAQ's removeTwofactorConfig() endpoint when validating codes for two-factor authentication removal, with neither lockout nor rate limiting enforced. A remote attacker can use an already-authenticated victim session and its removal CSRF token to submit unlimited code guesses to POST /api/user/remove-twofactor until a valid code disables the account's two-factor authentication.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to modify any news item's content and publication status without edit permission, affecting the public front page and REST API.

The vulnerability exists due to incorrect authorization in phpMyFAQ's news update controller when processing PUT requests, checking NEWS_DELETE instead of NEWS_EDIT. A remote privileged user can use NEWS_ADD access to obtain an update-news CSRF token from their own cookie and submit a crafted update request with NEWS_DELETE permission to rewrite news without NEWS_EDIT.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose unpublished FAQ question text and edit URLs, recent-account identities and registration timestamps, site-wide statistics, and the last-backup date.

The vulnerability exists due to missing authorization in the phpMyFAQ administration dashboard controller when rendering administrative widgets after checking only authentication. A remote user can send GET /admin/index.php/ using an activated account with no administrative permissions to read this restricted information, but not draft answer bodies.


4) Cross-site request forgery (CVE-ID: CVE-2026-111907)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to trigger unauthorized database migrations, potentially compromising database integrity and causing a denial of service.

The vulnerability exists due to missing CSRF token validation in phpMyFAQ's updateDatabase() function when handling requests to /admin/api/update-database. A remote attacker can trick a logged-in user with CONFIGURATION_EDIT permission into submitting a cross-site POST request to execute database migrations using the victim's session.


5) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-111908)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify or deactivate restricted FAQs, bypass moderation, and potentially expose restricted content through forced publication.

The vulnerability exists due to missing object-level authorization in phpMyFAQ's PUT /api/v3.1/faq/update endpoint when updating FAQs using a supplied ID and language. A remote user can submit an update request with edit_faq permission and a restricted FAQ's ID to alter content outside their authorized scope.


6) Incorrect authorization (CVE-ID: CVE-2026-111909)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete superadmin accounts in phpMyFAQ, potentially causing loss of administrative access and accountability.

The vulnerability exists due to a missing superadmin authorization check in UserController.php's deleteUser() method when processing account deletion requests. A remote user can use a non-superadmin account with the delete_user permission to send a DELETE request to /admin/api/user/delete targeting a superadmin account whose ID is not 1 to delete that account.


7) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose files attached to access-restricted FAQs.

The vulnerability exists due to incorrect authorization in phpMyFAQ's attachment download handler when evaluating record permissions, mishandling the all-users sentinel, bypassing group checks in basic mode, and allowing the guest-download flag to override record ACLs. A remote attacker can request restricted attachments anonymously when guest downloads are enabled, or through an account with download rights in basic mode, to retrieve files without permission to view their associated FAQs.


8) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to take over accounts with known usernames, including administrator accounts, bypassing passwords and TOTP authentication.

The vulnerability exists due to missing authentication and challenge validation in phpMyFAQ's WebAuthn registration endpoints when WebAuthn support is enabled. A remote attacker can obtain an anonymous CSRF token, stage a victim's username through /api/webauthn/prepare, and submit a fabricated fmt=none attestation to /api/webauthn/register to attach an attacker-controlled credential and log in as the victim.


9) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain complete attachments belonging to unpublished FAQs, potentially disclosing confidential information.

The vulnerability exists due to missing parent-publication and visibility authorization checks in phpMyFAQ's attachment download handlers when serving attachment requests. A remote user can request attachment identifiers through index.php?action=attachment&id=<ID> or /attachment/<ID> with dlattachment permission, or potentially through enabled guest downloads, to retrieve files whose parent FAQs are inaccessible.


10) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-111905)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose other users' live TOTP secrets and bypass their two-factor authentication, including SuperAdmin accounts.

The vulnerability exists due to authorization bypass through a user-controlled key in phpMyFAQ's GET /admin/api/user/data/{userId} endpoint when returning unsanitized user records without SuperAdmin or protected-target checks. A remote user can use delegated USER_ADD, USER_EDIT, and USER_DELETE rights to request another user's ID, retrieve the secret, and generate valid second-factor codes to bypass two-factor authentication.


Remediation

Install update from vendor's website.

References