CVE-2026-111905: phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated administrators with user-management rights can read a SuperAdmin's TOTP secret and generate valid codes to bypass two-factor authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated delegated administrator with user-management rights can exploit it. The attacker does not need SuperAdmin privileges, but can target a SuperAdmin account through the affected API endpoint.
What does an attacker need to do to bypass a SuperAdmin's two-factor authentication?
The attacker can request the target user's data through GET /admin/api/user/data/{userId} and obtain the live TOTP secret from the returned faquserdata row. They can then generate valid TOTP codes for that SuperAdmin account.
Which releases are affected?
Affected releases are phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. Versions 4.1.9 and 4.2.0-beta are not included in the affected ranges stated here.