Cross-site request forgery in phpMyFAQ - CVE-2026-111906
Published: November 11, 2026
Vulnerability identifier: #VU165946
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111906
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disrupt search functionality and exhaust resources through unauthorized search index operations.
The vulnerability exists due to missing CSRF token validation in phpMyFAQ's ElasticsearchController and OpenSearchController when handling create, drop, and import actions. A remote attacker can lure a user with CONFIGURATION_EDIT permission to a malicious website that triggers requests through the user's authenticated browser to delete search indexes or force resource-intensive imports and re-indexing on a configured backend.
Affected software
phpMyFAQ
How to mitigate CVE-2026-111906
Install security update from vendor's website.
phpMyFAQ - update to 4.1.9