Cross-site request forgery in phpMyFAQ - CVE-2026-111907
Published: November 10, 2026
Vulnerability identifier: #VU164483
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111907
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to trigger unauthorized database migrations, potentially compromising database integrity and causing a denial of service.
The vulnerability exists due to missing CSRF token validation in phpMyFAQ's updateDatabase() function when handling requests to /admin/api/update-database. A remote attacker can trick a logged-in user with CONFIGURATION_EDIT permission into submitting a cross-site POST request to execute database migrations using the victim's session.
Affected software
phpMyFAQ
How to mitigate CVE-2026-111907
Install security update from vendor's website.
phpMyFAQ - update to 4.1.9