CVE-2026-111888: phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWSDELETE instead of NEWSEDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9
Event History
Frequently Asked Questions
Which accounts are exposed to this issue?
Delegated administrator accounts that have both addnews and delnews permissions but do not have the editnews permission are affected. They can modify news despite lacking the intended edit authorization.
What does an attacker need to exploit it?
An attacker needs access to such a delegated administrator account and its update-news CSRF token, which they can read from their own cookie. They can then call the PUT /admin/api/news/update endpoint.
What could an unauthorized user change?
They can rewrite any news item's header, body, author, link, and active flag. This can alter content displayed on the public front page.
How can I determine whether an installation is affected?
Installations running phpMyFAQ 4.0.0 through versions before 4.1.9 are affected. Review delegated administrator roles for accounts that combine addnews and delnews while lacking editnews, and check whether they can access the news update API.