Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck

CVE-2026-111888phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API

Low 2.7

In plain English

A low-severity incorrect authorization in phpMyFAQ from thorsten. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.3%top 82.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	4.0.0 – before 4.1.9

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-287v-6c6j-x9f7) vendor-advisory
VulnCheck Advisory: phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API third-party-advisory