Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-111908

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

thorsten phpMyFAQ

Default version status: unaffected

  • 4.0.0 to < 4.1.9affected
  • 4.1.9unaffected

thorsten phpMyFAQ

Default version status: unaffected

  • 4.2.0-alpha to < 4.2.0-betaaffected
  • 4.2.0-betaunaffected

References