CVE-2026-111884: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
What must an attacker obtain before exploiting this issue?
The attacker needs a hijacked authenticated session and must be able to submit the account e-mail change with the session and a valid CSRF token. No current-password verification is required for that change in affected versions.
Which accounts are most exposed to takeover?
Accounts without two-factor authentication can be taken over through the password-reset flow after the attacker changes the account e-mail address. This includes superadmin accounts if they do not have 2FA.
Are default deployments affected?
The issue affects phpMyFAQ versions before 4.1.9 and 4.2.0-alpha versions before 4.2.0-beta. The vulnerable e-mail-change path relies on session and CSRF-token checks rather than requiring the current password.
How can administrators identify possible exploitation?
Review account e-mail changes, especially changes followed by password-reset activity, for unexpected mailbox addresses. Investigate these events urgently for privileged accounts and accounts not protected by 2FA.