CVE-2026-111889: phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any activated account can request /admin/index.php/ to read unpublished FAQ questions, admin edit URLs, recent user identities, and site statistics.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with an activated account can exploit it; administrator privileges are not required. The attacker must be able to send a request to /admin/index.php/.
What information can an unauthorized user access?
Affected systems may expose unpublished FAQ questions, administrative edit URLs, identities of recent users, and site statistics through the admin dashboard endpoint.
Which releases are affected?
phpMyFAQ 4.1.0 through versions before 4.1.9 are affected, as are 4.2.0-alpha releases before 4.2.0-beta.
How can I check whether the issue is exploitable in my deployment?
Using a non-administrator activated account, request /admin/index.php/. If the account can view admin dashboard data such as unpublished questions, edit URLs, recent user identities, or statistics, the deployment is affected.