Incorrect authorization in phpMyFAQ - #VU164478
Published: November 10, 2026
Vulnerability identifier: #VU164478
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to modify any news item's content and publication status without edit permission, affecting the public front page and REST API.
The vulnerability exists due to incorrect authorization in phpMyFAQ's news update controller when processing PUT requests, checking NEWS_DELETE instead of NEWS_EDIT. A remote privileged user can use NEWS_ADD access to obtain an update-news CSRF token from their own cookie and submit a crafted update request with NEWS_DELETE permission to rewrite news without NEWS_EDIT.
Affected software
phpMyFAQ
Remediation
Install security update from vendor's website.
phpMyFAQ - update to 4.1.9